zmuxuny opened a new pull request, #5365: URL: https://github.com/apache/rocketmq-dashboard/pull/5365
## Summary Refs #2376 and the earlier stale-closed, unmerged proposal #2377. Bound the raw message bodies retained by DLQ list, JSON export and Excel export scans to 10 MiB per request before UTF-8/Base64 conversion. Requests over the budget fail with HTTP 413 and a hint to narrow the time range. Budget exhaustion is propagated separately from queue failures, so it cannot silently become a partial-success export. Slice list results before encoding the requested page. Preserve the existing message-count caps and resend behavior. Selected Excel exports still scan before filtering, so their scans share the same bound. The API documentation explains the limit and recovery. ## Verification - Fail-before on unchanged production code at `6a68042f`: 13 new provider cases ran; 8 failed as expected (missing byte limits and eager off-page conversion), 5 compatibility cases passed - Final related backend matrix: **115 tests passed**, 0 failures/errors/skips: `RocketMQDLQPayloadBudgetTest,RocketMQDLQProviderTest,DLQControllerTest,DLQServiceTest,DLQMessageExcelRowTest,MessageQueryDlqToolHandlerTest,MessageRedeliveryDlqToolHandlerTest` - Covers accumulation across messages, pull batches and queues; prior queue failure followed by overflow; all read endpoints including selected Excel; exact byte limit; null body; page-only conversion; time-window exclusions; preserved count caps and unchanged resend bodies - Controller regressions verify HTTP 413 for list/JSON/XLSX without a download attachment header - Production and test sources compile; Checkstyle reports 0 violations; `git diff --check` passes - Independent code review completed Local runner: Temurin 21, Maven 3.9.11, one test fork, 512 MiB heaps; Mockito attached at JVM startup because normal self-attachment is unavailable. No live broker or full backend integration suite was run. ## Scope This limits retained raw bodies and their encoding amplification. It is not a total JVM heap guarantee: message properties, a pull response already decoded by the RocketMQ client, and concurrent requests are outside this per-request budget. No broker setting, credential, dependency or configuration change. AI assistance was used for implementation, regression tests and review. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
