RockteMQ-AI commented on issue #1551: URL: https://github.com/apache/rocketmq-dashboard/issues/1551#issuecomment-5248869395
**Issue Evaluation** Category: `bug` | Status: **Confirmed** | ⚠️ **Security-relevant** The reported issue is valid and has been verified against the codebase. `UserContext#init()` uses `authMode.toLowerCase()` to determine the authentication strategy. In the Turkish locale, `"ACL".toLowerCase()` produces `"acl"` correctly, but `"FILE".toLowerCase()` produces `"fıle"` (with dotless i), which would fall through to the `default` case. More critically, if the configured `authMode` value is compared using locale-sensitive case conversion elsewhere in the auth pipeline, authentication could be bypassed. **Root Cause:** `switch (authMode.toLowerCase())` at `UserContext.java:40` uses locale-sensitive lowercasing. **Severity:** High — potential authentication bypass depending on JVM locale configuration. An automated fix proposal can be generated. Reply `/approve` to proceed with PR generation. --- *Automated evaluation by github-manager* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
