RockteMQ-AI commented on issue #1316: URL: https://github.com/apache/rocketmq-dashboard/issues/1316#issuecomment-5231951747
**Issue Evaluation** Category: `bug` | Status: **Confirmed (with path correction)** The underlying concern is valid — the trace and message view endpoints accept blank/whitespace-only `msgId` values without validation: - `MessageTraceController.viewTraceMessages(@RequestParam String msgId)` — no blank check - `MessageTraceController.viewMessageTraceGraph(@RequestParam String msgId, ...)` — no blank check - `MessageController.viewMessage(@RequestParam String msgId)` — no blank check However, the file path referenced in this issue (`server/src/main/java/org/apache/rocketmq/studio/instance/message/MessageService.java`) does not exist in the current codebase. The actual classes are: - `src/main/java/org/apache/rocketmq/dashboard/controller/MessageTraceController.java` - `src/main/java/org/apache/rocketmq/dashboard/controller/MessageController.java` The package is `org.apache.rocketmq.dashboard`, not `org.apache.rocketmq.studio`. **Suggested fix:** Add `StringUtils.hasText(msgId)` validation at the controller or service boundary and return HTTP 400 for blank input. --- *Automated evaluation by github-manager-bot* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
