tju-yxq opened a new issue, #2438: URL: https://github.com/apache/rocketmq-dashboard/issues/2438
## Please describe the issue you observed `GET /api/acl/rules` normalizes `page < 1` to `1` and `pageSize < 1` to `20`, but it does not cap an explicitly supplied large `pageSize`. A request such as `pageSize=100000` is passed directly to `AclService.listRules` and then to the MyBatis-Plus repository query. The Tencent branch performs the same in-memory filtering and slicing without a bound. By contrast, `GET /api/acl/users/page` rejects `pageSize` outside `1..100`, and other Studio inventory endpoints cap page sizes at 100. The rule inventory therefore has an inconsistent request contract and lets one response request an unbounded page. ### What did you do (The steps to reproduce)? 1. Call `GET /api/acl/rules?page=1&pageSize=100000`. 2. Observe that the value is accepted and forwarded to the repository. 3. Compare it with `GET /api/acl/users/page?page=1&pageSize=101`, which returns 400. ### What did you expect to see? The ACL rule inventory should use the same bounded pagination contract as the ACL user inventory: `page >= 1`, `pageSize >= 1`, and `pageSize <= 100`. Invalid explicit values should return a 400 before a repository query is issued. ### What did you see instead? An arbitrarily large `pageSize` is accepted, allowing one request to ask for an unbounded ACL rule page and creating an inconsistent API contract with the user inventory. ## Please tell us about your environment - Branch: `rocketmq-studio` - Component: ACL rule inventory API (`AclService`, `AclController`, `MybatisPlusAclRepository`) ## Other information A focused regression test should cover: - explicit `pageSize > 100` rejected with 400; - explicit `page < 1` or `pageSize < 1` rejected rather than silently normalized; - valid `1..100` values still passed through for both Apache and Tencent paths. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
