R0CKing666 opened a new pull request, #11183: URL: https://github.com/apache/rocketmq/pull/11183
### Which Issue(s) This PR Fixes - Fixes #11182 ### Brief Description `StatefulAuthorizationStrategy` built its authorization cache key from `channelId + subjectKey + resourceKey + actions + sourceIp`, omitting `rpcCode`, while the rpcCode whitelist check lived inside `doEvaluate()` (the cache mapping function). A whitelisted request therefore cached an ALLOW under a key shared with non-whitelisted requests, letting them skip ACL evaluation entirely. This change: - short-circuits whitelisted rpcCodes before the cache lookup, so a whitelisted request neither reads nor writes the cache; - includes `rpcCode` in the cache key, so the cache dimension covers every input that affects the decision. ### How Did You Test This Change? - `StatefulAuthorizationWhitelistCacheTest`: regression test — a non-whitelisted request sharing the whitelisted request's channel/subject/resource/actions/sourceIp is now denied instead of reusing a cached ALLOW. - `StatefulAuthorizationStrategyTest`: existing 4 tests still pass. - Built with `mvn -pl auth -Dtest=StatefulAuthorizationWhitelistCacheTest,StatefulAuthorizationStrategyTest test`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
