tju-yxq opened a new pull request, #1420:
URL: https://github.com/apache/rocketmq-dashboard/pull/1420

   ## What is the purpose of the change
   
   Fixes #1419
   
   The alert rule `operator`, `metric`, and `duration` fields were injected 
directly into PromQL expressions without validation. Malformed values (e.g., 
operator = `"> 0) or vector(999"`) could produce invalid PromQL that causes 
Prometheus rule loading to fail.
   
   ## Brief changelog
   
   - **`AlertService.java`**: Added `VALID_OPERATORS` whitelist (`>`, `>=`, 
`<`, `<=`, `==`, `!=`).
   - **`AlertService.java`**: Added `METRIC_NAME_PATTERN` regex 
(`^[a-zA-Z_:][a-zA-Z0-9_:]*$`).
   - **`AlertService.java`**: Added `DURATION_PATTERN` regex 
(`^\d+(ms|s|m|h|d|w|y)$`).
   - **`AlertService.java`**: Added `validateMetric()` and `validateOperator()` 
helper methods.
   - **`AlertService.java`**: Updated `expression()` and `duration()` to use 
validated values, falling back to safe defaults for invalid input.
   
   ## Verifying this change
   
   1. Create an alert rule with operator = `"> 0) or vector(999"`.
   2. Export Prometheus rules YAML.
   3. Before fix: invalid PromQL in the exported YAML, Prometheus rejects.
   4. After fix: operator falls back to `>`, valid PromQL is generated.
   
   - [x] Make sure there is a Github issue filed for the change.
   - [x] Format the pull request title like `[ISSUE #1419] ...`.
   - [x] Write a pull request description that is detailed enough to understand 
what the pull request does, how, and why.
   - [x] Write necessary unit-test to verify your logic correction.
   - [x] Run `mvn -B clean apache-rat:check findbugs:findbugs 
checkstyle:checkstyle` to make sure basic checks pass.
   - [ ] If this contribution is large, please file an Apache Individual 
Contributor License Agreement.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to