You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "btlqql (via GitHub)" <gi...@apache.org> on 2026/09/13 08:52:22 UTC
[I] [Studio][Bug] Clearing an instance admin credential reference has no effect [rocketmq-dashboard]
btlqql opened a new issue, #4273:
URL: https://github.com/apache/rocketmq-dashboard/issues/4273
## 1. Symptom
An instance's admin credential reference cannot be removed. In the instance edit dialog (`web/src/pages/instance/index.tsx`, "Admin Credential Ref" field) clearing the value and saving returns HTTP 200 and the edited row looks updated, but `rmq_instance.admin_credential_ref` still holds the previous reference, so it reappears on the next list load.
## 2. Root cause
`server/src/main/java/org/apache/rocketmq/studio/instance/InstanceService.java:602-604`
```java
if (!cloudInstance && instance.getAdminCredentialRef() != null) {
updated.setAdminCredentialRef(normalizeCredentialRef(instance.getAdminCredentialRef()));
}
```
`normalizeCredentialRef` (`InstanceService.java:561-563`) maps a blank submission to `null`, so a blank reference is an explicit clear and a non-null `updated` field is written as null. But `updated` (a copy of the stored instance, `:580`) goes out through `instanceRepository.save(updated)` (`:607`), and `MybatisPlusInstanceRepository.save` writes the update with `instanceMapper.updateById(entity)` (`MybatisPlusInstanceRepository.java:122`).
MyBatis-Plus `updateById` omits null entity fields (`FieldStrategy.NOT_NULL`, no `update-strategy` override in `application.yml`), so the null reference never reaches the SET clause: the column keeps its previous value while the service returns a VO whose reference is null. This is the same mechanism that was already fixed for the ACL user/rule columns in #3342, and for a cleared `white_remote_address` before that.
The repository is also the only place that can fix it correctly: the service cannot express "clear this column" through the plain entity-based `save`, and the update path is the repository's own concern (`InstanceRepository.save` is called only from `InstanceService` at `:223` (insert) and `:607` (update)).
## 3. Impact
- A security-relevant piece of instance configuration is write-once: an operator can set or change the external admin credential reference but cannot remove it, even though the API accepts the clear.
- The response contradicts the database: the API returns `adminCredentialRef: null` while MySQL still stores the reference, and the UI replaces its row with that response without refetching (the edit handler uses the returned instance, `web/src/pages/instance/index.tsx:447-455`), so the wrong value is displayed until the next manual reload.
- Any client of `POST /api/instances/update` (or the equivalent instance-update endpoint) hits the same silent no-op.
## 4. Reproduction
1. Create an Apache-type instance with `adminCredentialRef = "production-admin"`.
2. Update it with `adminCredentialRef = ""` (the edit dialog sends the cleared input verbatim).
3. Effect: HTTP 200, response `adminCredentialRef` is null.
4. `SELECT admin_credential_ref FROM rmq_instance WHERE id = <id>` still returns `production-admin`.
## 5. Expected behaviour
- A blank reference clears the column (NULL), matching `normalizeCredentialRef`'s intent.
- An omitted reference (`null` in the request) keeps the stored value.
- The returned instance reflects the persisted state.
- Cloud instances stay unchanged: the field is only assignable for Apache instances (`InstanceService.java:602`), and the fix must not touch the insert path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Bug] Clearing an instance admin credential reference has no effect [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #4273:
URL: https://github.com/apache/rocketmq-dashboard/issues/4273#issuecomment-5753817108
This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Bug] Clearing an instance admin credential reference has no effect [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #4273: [Studio][Bug] Clearing an instance admin credential reference has no effect
URL: https://github.com/apache/rocketmq-dashboard/issues/4273
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Bug] Clearing an instance admin credential reference has no effect [rocketmq-dashboard]
Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins commented on issue #4273:
URL: https://github.com/apache/rocketmq-dashboard/issues/4273#issuecomment-5755340302
Resolved by #4466, merged into `rocketmq-studio` as f759510. `MybatisPlusInstanceRepository.save` now assigns `admin_credential_ref` explicitly when the update request omits it, instead of relying on MyBatis-Plus `updateById`, which skips null entity fields and therefore kept the previous reference. Reopening and closing as completed because the stale bot had auto-closed this as not planned.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Bug] Clearing an instance admin credential reference has no effect [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #4273:
URL: https://github.com/apache/rocketmq-dashboard/issues/4273#issuecomment-5655090743
**Issue Evaluation**
Category: `type/bug` | Status: **Confirmed**
Same root cause pattern as #4274 — clearing a reference field in the edit dialog and saving reports success but the previous value persists. The backend likely treats empty/null values as "no change" during updates. The fix should ensure empty values are properly persisted.
---
*Automated evaluation by github-manager*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Bug] Clearing an instance admin credential reference has no effect [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #4273:
URL: https://github.com/apache/rocketmq-dashboard/issues/4273#issuecomment-5652596100
**Issue Evaluation**
Category: | Status: **Confirmed**
The reported issue has been verified against the current codebase.
**Root Cause:** MyBatis-Plus uses by default, which omits null entity fields from the clause. When maps a blank submission to , the call is silently dropped by , so the column retains its previous value while the API returns the null value from the in-memory entity.
**Impact:** Security-relevant — an admin credential reference becomes write-once. Operators cannot clear it through the UI despite the API appearing to accept the change. The UI displays stale data until the next manual reload.
**Severity:** High — silent data inconsistency in a security-sensitive configuration field.
**Suggested Fix:** The repository layer should use an explicit or to set the column to when the credential ref is blank, bypassing the field strategy. This is consistent with the prior fixes for ACL user/rule columns (#3342) and .
An automated fix proposal will be generated. Reply to proceed with PR generation.
---
*Automated evaluation by github-manager*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Bug] Clearing an instance admin credential reference has no effect [rocketmq-dashboard]
Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins closed issue #4273: [Studio][Bug] Clearing an instance admin credential reference has no effect
URL: https://github.com/apache/rocketmq-dashboard/issues/4273
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org