unbridled-41 opened a new pull request, #2835:
URL: https://github.com/apache/rocketmq-dashboard/pull/2835
## What is the purpose of the change
Fixes #2834.
`POST /api/dlq/resend` and `/api/dlq/resend-selected` accept a
user-controlled `targetTopic` that `RocketMQDLQProvider.resolveTargetTopic`
returns verbatim and `resendOne` passes to `producer.send()`. A `targetTopic`
of `%DLQ%<sameGroup>` feeds dead letters back into the DLQ being drained
(unbounded growth on repetition), system topics such as `RMQ_SYS_TRACE_TOPIC`
or `SCHEDULE_TOPIC_XXXX` get poisoned, and on clusters with
`autoCreateTopicEnable=true` any non-existent name silently creates a new topic
outside the audited topic-creation flow.
## Brief changelog
- Add `validateResendTargetTopic`, called once per resend request before
scanning/dispatching when an explicit `targetTopic` is present:
- `TopicValidator.validateTopic` rejects invalid topic names;
- `SystemTopicFilter.isSystem` rejects RocketMQ system, `%RETRY%` and
`%DLQ%` topics;
- the target must exist in the instance's `fetchAllTopicList` so resend
cannot act as an implicit topic-creation primitive.
- Legitimate cross-topic resend to an existing business topic is unchanged.
- Tests: new red/green-verified cases for retry/DLQ targets, system topics,
invalid names and missing targets; existing resend tests stub the topic list
for their valid targets.
## Verifying this change
- `mvn -f server/pom.xml -Dtest=RocketMQDLQProviderTest test` — 24 tests
pass.
- Red/green: with the production change stashed, the four new validation
tests all fail (the forged targets reach the send path); with the fix they pass.
- Full `mvn -B test` run in progress on this branch (link to follow in a
comment).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
