[I] ACL risk diagnostic underrates noncanonical /0 whitelists [rocketmq-dashboard]

["Loyal-Young (via GitHub)" <gi...@apache.org>]

Loyal-Young opened a new issue, #7108:
URL: https://github.com/apache/rocketmq-dashboard/issues/7108

   ## Problem
   
   The ACL risk diagnostic calls only the literal strings `0.0.0.0/0`, `::/0`, and `0/0` an open whitelist. A valid `/0` CIDR with another address spelling (for example `10.0.0.0/0` or `2001:db8::/0`) covers the whole address family too, but is classified merely as broad. As a result, an open account or global whitelist receives a warning instead of the critical severity shown for the equivalent canonical spelling.
   
   ## Expected behavior
   
   Any CIDR with a zero prefix should be classified as open, independently of the address before the slash. Broad nonzero prefixes should retain their current warning classification.
   
   ## Proposed fix
   
   Use the parsed CIDR prefix to identify zero-prefix entries and add focused diagnostics tests for IPv4, IPv6, and nonzero controls.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] ACL risk diagnostic underrates noncanonical /0 whitelists [rocketmq-dashboard]

["Loyal-Young (via GitHub)" <gi...@apache.org>]

Loyal-Young closed issue #7108: ACL risk diagnostic underrates noncanonical /0 whitelists
URL: https://github.com/apache/rocketmq-dashboard/issues/7108


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org