[I] Metrics basic authentication can be disabled by the JVM default locale [rocketmq-dashboard]

["123123213weqw (via GitHub)" <gi...@apache.org>]

123123213weqw opened a new issue, #1551:
URL: https://github.com/apache/rocketmq-dashboard/issues/1551

   ## Problem
   Metrics data-source auth labels are lowercased with the JVM default locale. With a Turkish default locale, `BASIC AUTH` becomes `basıc auth`, is treated as unknown, and silently disables authentication for the query.
   
   ## Proposed fix
   Normalize auth identifiers with `Locale.ROOT` and add a regression test that captures the generated data-source configuration under a Turkish locale.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Metrics basic authentication can be disabled by the JVM default locale [rocketmq-dashboard]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] commented on issue #1551:
URL: https://github.com/apache/rocketmq-dashboard/issues/1551#issuecomment-5389250328

   This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Metrics basic authentication can be disabled by the JVM default locale [rocketmq-dashboard]

["RockteMQ-AI (via GitHub)" <gi...@apache.org>]

RockteMQ-AI commented on issue #1551:
URL: https://github.com/apache/rocketmq-dashboard/issues/1551#issuecomment-5248869395

   **Issue Evaluation**
   
   Category: `bug` | Status: **Confirmed** | ⚠️ **Security-relevant**
   
   The reported issue is valid and has been verified against the codebase. `UserContext#init()` uses `authMode.toLowerCase()` to determine the authentication strategy. In the Turkish locale, `"ACL".toLowerCase()` produces `"acl"` correctly, but `"FILE".toLowerCase()` produces `"fıle"` (with dotless i), which would fall through to the `default` case.
   
   More critically, if the configured `authMode` value is compared using locale-sensitive case conversion elsewhere in the auth pipeline, authentication could be bypassed.
   
   **Root Cause:** `switch (authMode.toLowerCase())` at `UserContext.java:40` uses locale-sensitive lowercasing.
   
   **Severity:** High — potential authentication bypass depending on JVM locale configuration.
   
   An automated fix proposal can be generated. Reply `/approve` to proceed with PR generation.
   
   ---
   *Automated evaluation by github-manager*
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Metrics basic authentication can be disabled by the JVM default locale [rocketmq-dashboard]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] closed issue #1551: Metrics basic authentication can be disabled by the JVM default locale
URL: https://github.com/apache/rocketmq-dashboard/issues/1551


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org