[PR] [ISSUE #1689] Protect credential views with matrix parameters [rocketmq-dashboard]

["youngkermit8-coder (via GitHub)" <gi...@apache.org>]

youngkermit8-coder opened a new pull request, #1691:
URL: https://github.com/apache/rocketmq-dashboard/pull/1691

   ## Summary
   
   - normalize matrix-parameter content before checking administrator-only credential paths;
   - keep both ACL-user and cloud-credential secret views protected when semicolon parameters appear on any path segment;
   - add controller-level authorization regressions for reader rejection and administrator access.
   
   ## Root cause
   
   The authorization interceptor compared the raw servlet path with `endsWith("/credentials")`, while Spring MVC removes matrix parameters when matching routes. A path such as `/api/acl/users/user-1/credentials;probe=1` therefore still reached the credential controller, but no longer matched the interceptor's administrator-only suffix check.
   
   ## Impact
   
   Authenticated non-admin readers can no longer bypass credential-view authorization with legal matrix parameters. Administrators retain access, and unrelated read-only routes keep their existing policy.
   
   ## Reproduction and validation
   
   - both new reader regressions first failed on exact upstream `65d1c32`, resolving to the credential controllers and returning HTTP 200;
   - focused authorization integration test: 3/3 passed after the fix;
   - authentication and credential-controller regression set: 67/67 passed;
   - Checkstyle reported 0 violations;
   - `mvn -DskipTests package` succeeded.
   
   Closes #1689
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [ISSUE #1689] Protect credential views with matrix parameters [rocketmq-dashboard]

["lizhimins (via GitHub)" <gi...@apache.org>]

lizhimins merged PR #1691:
URL: https://github.com/apache/rocketmq-dashboard/pull/1691


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org