89799969 opened a new pull request, #4392: URL: https://github.com/apache/rocketmq-dashboard/pull/4392
### Which Issue(s) This PR Fixes - Fixes #4289 ### Brief Description `GET /api/audit/logs`, `GET /api/audit/summary` and the export path pass the search box value to a SQL `LIKE` across `operator`, `resource_name` and `detail` without escaping. `%` and `_` therefore keep their wildcard meaning: - `search=%` matches every audit row - `search=_` matches every non-empty value - a resource name containing `_` matches unintended rows Add a shared `SqlLikeUtil` (escape + explicit `ESCAPE '\\'` clause, H2-compatible) and use it in `MybatisPlusAuditRepository.applyFilters`, the single filter builder shared by the paged list, summary and export. ### How Did You Test This Change? ``` $ cd server && mvn -B -ntp test -Dtest='SqlLikeUtilTest,MybatisPlusAuditRepositoryTest' Tests run: 18, Failures: 0, Errors: 0, Skipped: 0 BUILD SUCCESS ``` New tests: - `SqlLikeUtilTest` pins escape order and the explicit ESCAPE clause - `findPageShouldEscapeLikeWildcardsInSearchTest` asserts the bound pattern is `%100\%\_done%` - `summarizeShouldEscapeLikeWildcardsInSearchTest` asserts the summary path uses the same escaped pattern ### Checklist - [x] One coherent change; unrelated modifications are not bundled in - [x] Commit subject follows Conventional Commits (`fix:`) - [x] Tests added or updated, test methods named `...Test` - [x] No new UI text - [x] Architecture constraints stay green - [x] New source files carry the ASF license header - [x] Documentation not required (search semantics fix) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
