tju-yxq opened a new issue, #5503: URL: https://github.com/apache/rocketmq-dashboard/issues/5503
## Problem Three ACL identity inputs are stored raw from the form while the same page (and the same submit handler!) trims their siblings — a copy-pasted value with invisible padding silently fragments the ACL identity: 1. **Rule `resource`** (`acl.tsx` `handleRuleSubmit`): pasted ` topic-a ` persists a LITERAL rule that never matches the real topic — the rule silently grants nothing. The backend (`AclService.createRule`/`MybatisPlusAclRepository.saveRule`) stores this field raw. 2. **User `username`** (`acl.tsx` `handleUserSubmit`): pasted ` alice ` creates a distinct user; the rule principal dropdown then offers both `alice` and ` alice ` as different identities. The backend stores the username raw in this flow (unlike the studio user flow, where `AuthService.java:306` trims). 3. **Plain-access `secretKey`** (`acl.tsx` `handlePlainSubmit`): the same spread already trims `accessKey` (`(values.accessKey ?? '').trim()`) but passes `secretKey` through raw — a pasted padded secret is stored padded (base64-encoded at `MybatisPlusAclRepository.java:270`), and clients authenticating with the intended secret are rejected by the broker. The page's own convention is to trim (`handlePlainSubmit` trims accessKey; `handleExamine` trims clusterId at line 491), so these three are oversights. ## What did you do (steps to reproduce)? 1. Create an ACL rule with a topic name pasted with leading/trailing spaces. 2. The rule is saved with the padded resource; it matches nothing. 3. Similarly: create an ACL user or plain-access secret with padded paste. ## What did you expect to see? Copy-pasted identities are trimmed at the form boundary, like the page's other inputs. ## What did you see instead? Padded values persisted raw, fragmenting ACL identity or silently breaking authentication. ## Root cause `web/src/pages/instance/acl.tsx` — `handleRuleSubmit` (around line 309), `handleUserSubmit` (around line 416), and `handlePlainSubmit` (around line 550) pass their values through verbatim (except the accessKey). ## Expected behavior - Rule `resource` is trimmed before create/update (the Tencent role mode's `*` is unaffected). - User `username` is trimmed before create/update. - Plain-access `secretKey` is trimmed (same treatment as the `accessKey` beside it). - All other form values and behaviors are unchanged. ## Acceptance criteria - [ ] A padded pasted rule resource is stored trimmed. - [ ] A padded pasted username is stored trimmed. - [ ] A padded pasted plain-access secret is stored trimmed. - [ ] All existing ACL page behaviors (validation, editing, Tencent role mode) are unchanged. ## Environment Branch `rocketmq-studio` at `6a68042f`; file: `web/src/pages/instance/acl.tsx`. ## Duplicate check Searched open and closed issues for `ACL trim`, `padded resource`, `ACL username`: nothing covers the missing trims on this page. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
