RockteMQ-AI commented on issue #2625:
URL:
https://github.com/apache/rocketmq-dashboard/issues/2625#issuecomment-5423134532
**Issue Evaluation**
Category: `type/bug` | Status: **Confirmed**
This is a valid **security vulnerability** — directory traversal via the
`date` parameter in `DashboardController`. The evidence is clear: the
user-controlled `date` parameter is concatenated directly into a file path
without any sanitization, allowing an attacker to read arbitrary `.json` files
outside the data directory.
**Root Cause:** Missing input validation at
`DashboardCollectServiceImpl.getBrokerCache(date)` / `getTopicCache(date)`
where `date` is concatenated into `new File(dataLocationPath + date + ".json")`.
**Impact:** Any unauthenticated user can read arbitrary files on the server
that end with `.json`, potentially exposing sensitive data.
**Severity:** **High** — This is a CWE-22 (Path Traversal) vulnerability
that should be fixed promptly.
**Proposed fix assessment:** The suggested fix (whitelist validation with
`DATE_PATTERN = \d{4}-\d{2}-\d{2}`) is appropriate and minimal. Adding
validation at the service layer boundary is the correct approach.
An automated fix proposal can be generated. Reply `/approve` to proceed with
PR generation.
---
*Automated evaluation by RockteMQ-AI*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
