pilichoumao opened a new issue, #6435: URL: https://github.com/apache/rocketmq-dashboard/issues/6435
### Description ACL risk diagnostics currently treat any `*` in `whiteRemoteAddress` as unrestricted access. The plain-access upsert validator accepts bounded native expressions such as `10.0.2.*`, `192.168.*.*`, and `1050::0005:0600:300c:1-20:*`. A non-admin account with DENY defaults and specific topic/group grants is therefore incorrectly reported as critical in the stored-account ACL summary. `10.*.*.*` is also graded as unrestricted rather than as a broad /8-sized range. ### Reproduction On `rocketmq-studio` at 779b8c0e7aed2396d3cc72743dcd544ea48e9ae6, analyze an ACL 2.0 summary with one non-admin account, `whiteRemoteAddress: "10.0.2.*"`, DENY defaults and specific grants. The diagnostic includes a critical BROAD_ACCOUNT_WHITELIST issue. ### Expected behavior Recognized native expressions should follow the existing breadth thresholds (IPv4 /8, IPv6 /16). Entire-address-space wildcards remain critical. Unrecognized or invalid wildcard forms retain the conservative current fallback; administrator and permission findings are preserved. The proposed fix is limited to frontend risk classification and regression coverage. It does not change address validation, authentication, ACL enforcement, thresholds, APIs or UI strings. The real summary is a dashboard-store account view, not a live Broker authentication test. Related #3010 introduced diagnostics, #3308 validates the native grammar, and #5568 concerns translations rather than this classification. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
