[I] [Bug] Maintenance label parsing silently overwrites duplicate selectors and loses __proto__ selectors [rocketmq-dashboard]

["Loyal-Young (via GitHub)" <gi...@apache.org>]

Loyal-Young opened a new issue, #6415:
URL: https://github.com/apache/rocketmq-dashboard/issues/6415

   ### Before Creating the Bug Report
   - [x] Searched for duplicates. Searched silence/labels and silence/duplicate; existing work concerns length limits, display, editing and acknowledgement, not selector loss during parsing.
   - [x] This concerns RocketMQ Studio.
   
   ### Studio Version
   rocketmq-studio, 779b8c0e7aed2396d3cc72743dcd544ea48e9ae6.
   
   ### Runtime Environment
   Windows; Java 21 / Node 24. Reproduction will use the real schedule/service or React hook with controlled dependencies.
   
   ### Connected RocketMQ Cluster
   No live broker is required for this defect.
   
   ### Describe the Bug
   The maintenance dialog builds labels by assigning into a plain object. __proto__=broker-a does not create an own label, so the request can become unscoped. Repeated labels such as broker=a,broker=b silently keep the latter. The backend also trims keys into a map without detecting collisions, so {"broker":"a"," broker ":"b"} silently changes the requested scope.
   
   ### Steps to Reproduce
   In a maintenance-window form enter __proto__=broker-a, or broker=a,broker=b. Submit otherwise valid fields and inspect the request. For the REST service, provide keys that become identical after trimming.
   
   ### What Did You Expect to See?
   Preserve every valid selector including ordinary object-property names, reject empty or duplicate normalized keys before creating a window, and retain the existing key=value syntax and localized validation message.
   
   ### Are You Willing to Submit a Pull Request?
   - [x] Yes, including regression and positive-path tests.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Maintenance label parsing silently overwrites duplicate selectors and loses __proto__ selectors [rocketmq-dashboard]

["lizhimins (via GitHub)" <gi...@apache.org>]

lizhimins commented on issue #6415:
URL: https://github.com/apache/rocketmq-dashboard/issues/6415#issuecomment-6190189538

   Resolved by #6430 (merged into `rocketmq-studio` as [`0d83a567d`](https://github.com/apache/rocketmq-dashboard/commit/0d83a567d)). The merge target is not the default branch, so this issue does not auto-close.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Maintenance label parsing silently overwrites duplicate selectors and loses __proto__ selectors [rocketmq-dashboard]

["lizhimins (via GitHub)" <gi...@apache.org>]

lizhimins closed issue #6415: [Bug] Maintenance label parsing silently overwrites duplicate selectors and loses __proto__ selectors
URL: https://github.com/apache/rocketmq-dashboard/issues/6415


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org