youngkermit8-coder opened a new issue, #5416: URL: https://github.com/apache/rocketmq-dashboard/issues/5416
### Before Creating the Bug Report - [x] I searched open issues and pull requests for the DLQ Excel `msgIds` selection behavior and did not find an equivalent report. - [x] This is a RocketMQ Studio defect. - [x] The exact tested revision is stated below. ### Studio Version `apache/rocketmq-dashboard`, `rocketmq-studio@6a68042fa73a513f40436ca721944b4de48181ec`, built from source. ### Runtime Environment Windows, Java 21, Maven 3.9.9, Spring MockMvc. The controller-level reproduction does not require a browser or database. ### Connected RocketMQ Cluster None for the MockMvc reproduction; `DLQService` is mocked. This report does not assert a production incident or an authorization bypass. ### Describe the Bug `GET /api/dlq/export-excel` accepts selected message IDs as repeated `msgIds` parameters. Indexed spellings such as `msgIds[]=msg-1`, `msgIds[0]=msg-1`, and `msgIds.0=msg-1` are not bound to its `@RequestParam List<String> msgIds`; a present `msgIds=` binds to an empty list. The existing export path treats an absent or empty selection as a request for the entire time window. A caller trying to export a selection can therefore receive a broader export than intended. ### Steps to Reproduce 1. On the revision above, call `/api/dlq/export-excel?instanceId=instance-1&groupName=test-group&msgIds%5B0%5D=msg-1` as an authorized caller, or exercise the same parameter through `DLQControllerTest` with MockMvc and a mocked service. 2. Observe that the controller does not receive the selected ID and proceeds to the whole-window export path. `msgIds[]=msg-1`, `msgIds.0=msg-1`, and `msgIds=` also reproduce the parameter-handling problem. 3. As a control, repeated names (`msgIds=msg-1&msgIds=msg-2`) bind as selected IDs. ### What Did You Expect to See? Only an omitted `msgIds` parameter should request a whole-window export. Malformed indexed names and a present but empty selection should return HTTP 400; repeated `msgIds` names should continue to work. ### What Did You See Instead? MockMvc reproductions reached the export path without the requested selection. No live-cluster incident or cross-user data exposure has been measured. ### Additional Context This is distinct from open PRs #4927 (scan-cap disclosure), #5205 (binary body preservation), and #5400 (double submission). AI assistance was used to investigate and verify the reproduction; the submitted claims are limited to the observed tests. ### Are You Willing to Submit a Pull Request? - [x] Yes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
