tju-yxq opened a new pull request, #1420: URL: https://github.com/apache/rocketmq-dashboard/pull/1420
## What is the purpose of the change Fixes #1419 The alert rule `operator`, `metric`, and `duration` fields were injected directly into PromQL expressions without validation. Malformed values (e.g., operator = `"> 0) or vector(999"`) could produce invalid PromQL that causes Prometheus rule loading to fail. ## Brief changelog - **`AlertService.java`**: Added `VALID_OPERATORS` whitelist (`>`, `>=`, `<`, `<=`, `==`, `!=`). - **`AlertService.java`**: Added `METRIC_NAME_PATTERN` regex (`^[a-zA-Z_:][a-zA-Z0-9_:]*$`). - **`AlertService.java`**: Added `DURATION_PATTERN` regex (`^\d+(ms|s|m|h|d|w|y)$`). - **`AlertService.java`**: Added `validateMetric()` and `validateOperator()` helper methods. - **`AlertService.java`**: Updated `expression()` and `duration()` to use validated values, falling back to safe defaults for invalid input. ## Verifying this change 1. Create an alert rule with operator = `"> 0) or vector(999"`. 2. Export Prometheus rules YAML. 3. Before fix: invalid PromQL in the exported YAML, Prometheus rejects. 4. After fix: operator falls back to `>`, valid PromQL is generated. - [x] Make sure there is a Github issue filed for the change. - [x] Format the pull request title like `[ISSUE #1419] ...`. - [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why. - [x] Write necessary unit-test to verify your logic correction. - [x] Run `mvn -B clean apache-rat:check findbugs:findbugs checkstyle:checkstyle` to make sure basic checks pass. - [ ] If this contribution is large, please file an Apache Individual Contributor License Agreement. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
