RockteMQ-AI commented on issue #2429: URL: https://github.com/apache/rocketmq-dashboard/issues/2429#issuecomment-5352087392
**Issue Evaluation** Category: | Status: **Confirmed** This is a valid bug with security implications. A GET endpoint that triggers violates the principle of least privilege and HTTP semantics (GET must be safe/idempotent per RFC 7231 §4.2.1). A read-only user opening consumer diagnostics can silently mutate broker metadata, and partial failures leave inconsistent state. **Severity:** high — read-only users can create topics; violates REST contract and RBAC expectations. **Impact:** Broker metadata mutation from diagnostic reads; partial creation failures leave inconsistent routes. **Suggested fix:** Replace the call in the diagnostic path with a non-mutating check (e.g. or similar). If the retry topic is missing, return an empty/offline diagnostic state rather than creating it. Noted: author has self-assigned (). --- *Automated evaluation by RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
