You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "Frun1na (via GitHub)" <gi...@apache.org> on 2026/10/15 19:08:59 UTC
[I] [Bug] The demo ACL store accepts the blank ACL fields the backend rejects with 400 [rocketmq-dashboard]
Frun1na opened a new issue, #6818:
URL: https://github.com/apache/rocketmq-dashboard/issues/6818
### Before Creating the Bug Report
- [x] I have searched the [open issues](https://github.com/apache/rocketmq-dashboard/issues) of this repository and believe that this is not a duplicate.
- [x] This is a defect in RocketMQ Studio, not a usage question and not a defect in another Apache RocketMQ repository.
- [x] I can reproduce this on the current `rocketmq-studio` branch, or I have stated the exact version I am running below.
### Studio Version
branch: rocketmq-studio
git commit id: a92c2314
deployed as: reproduced by a unit test against that commit
### Runtime Environment
OS: Ubuntu on WSL2 (unit-test reproduction)
MySQL: not applicable — the defect is in the web demo (mock) data source
browser (for UI issues): not applicable — the defect is reproduced at the service layer
### Connected RocketMQ Cluster
not applicable — reproduced with the bundled demo data source in a unit test
### Describe the Bug
In demo-data mode the ACL store in `web/src/services/aclService.ts` writes blank values for fields
the backend refuses.
`createAclUser` (`web/src/services/aclService.ts:180`) stores `{ username: ' ' }` as a new ACL user
and resolves, while the endpoint answers 400: `AclService.createUser` rejects a username that is
blank after trimming
(`server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclService.java:236-238`, "ACL
username is required").
The same gap exists in the other two ACL write branches:
- `createAclRule` (`web/src/services/aclService.ts:131`) accepts a blank `principal` or `resource`;
the endpoint answers 400 for both (`AclService.java:127`, `:130`).
- `createAndUpdatePlainAccessConfig` (`web/src/services/aclService.ts:255`) accepts an empty
`accessKey`; the endpoint answers 400 "accessKey is required" (`AclService.java:313-315`).
The console can produce these inputs: the ACL page's user dialog and rule dialog declare only
`required` for their text inputs (`web/src/pages/instance/acl.tsx:1695`, `:1628`) and the Ant
validator accepts a whitespace-only value, so `handleUserSubmit` (`:452`) submits it unchanged;
`handlePlainSubmit` trims the access key before calling the service (`:665`), so a whitespace-only
access key is submitted as an empty string.
### Steps to Reproduce
1. Start the web console, switch the data source to the demo (mock) mode and open an instance's ACL tab.
2. Create a user whose name is a single space (the form accepts it); the same with a rule whose
resource is a space, or a plain access account whose access key is a space.
3. Observe: the console reports success and the ACL table gains a row with a blank name.
The defect is also reproducible at the service level:
```
$ cd web && npx vitest run src/services/aclService.test.ts
FAIL src/services/aclService.test.ts > ACL service mock data > rejects the blank ACL fields the backend requires text for
AssertionError: promise resolved "{ id: 1792091005046, …(6) }" instead of rejecting
+ {
+ "accessKey": "",
+ "admin": false,
+ "clusters": [],
+ "gmtCreate": "2026-10-15T19:03:25.046Z",
+ "id": 1792091005046,
+ "secretKey": "",
+ "username": " ",
+ }
```
### What Did You Expect to See?
The demo ACL store rejects a value the backend rejects — the same 400 a real instance returns ("ACL
username is required" / "ACL principal is required" / "ACL resource is required" / "accessKey is
required") — and no nameless row is added to the ACL tables.
### What Did You See Instead?
`createAclUser({ username: ' ' })` resolves with the created user (the output above), so the demo
reports success and the ACL user table gets a row whose name is blank. A blank rule resource and a
blank access key behave the same way.
### Additional Context
A fix with a regression test follows in a pull request.
### Are You Willing to Submit a Pull Request?
- [x] Yes, I am willing to submit a pull request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] The demo ACL store accepts the blank ACL fields the backend rejects with 400 [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #6818:
URL: https://github.com/apache/rocketmq-dashboard/issues/6818#issuecomment-6355262406
This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Bug] The demo ACL store accepts the blank ACL fields the backend rejects with 400 [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #6818: [Bug] The demo ACL store accepts the blank ACL fields the backend rejects with 400
URL: https://github.com/apache/rocketmq-dashboard/issues/6818
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org