Skip to content

[Studio] fix: validate audit query and cleanup parameters#442

Merged
lizhimins merged 1 commit into
apache:rocketmq-studiofrom
btlqql:agent/studio-audit-input-validation
Jul 17, 2026
Merged

[Studio] fix: validate audit query and cleanup parameters#442
lizhimins merged 1 commit into
apache:rocketmq-studiofrom
btlqql:agent/studio-audit-input-validation

Conversation

@btlqql

@btlqql btlqql commented Jul 16, 2026

Copy link
Copy Markdown

Summary

  • validate audit query pagination before reading repository data
  • use long arithmetic for pagination bounds to avoid integer overflow
  • reject zero or negative audit cleanup retention values
  • add regression tests for invalid and extreme inputs

Problem and root cause

AuditService.queryLogs used unchecked int values directly in subList index calculations. Non-positive inputs could produce invalid indices, and multiplying large positive page values could overflow. cleanupLogs similarly accepted non-positive retention periods, allowing a cutoff at the current time or in the future and risking deletion of recent audit entries.

Impact

Invalid requests now fail predictably with BusinessException code 400 before repository work begins. Valid large pagination inputs no longer overflow, and cleanup always requires a positive retention period.

Verification

  • mvn -o -B -ntp -Dtest=AuditServiceTest test — 16 tests passed
  • mvn -o -B -ntp test — 161 tests passed
  • Checkstyle — 0 violations
  • git diff --cached --check — passed

Fixes #441

@lizhimins lizhimins changed the title [Studio][fix] Validate audit query and cleanup parameters [Studio] fix: validate audit query and cleanup parameters Jul 17, 2026
@lizhimins
lizhimins merged commit b5f7da4 into apache:rocketmq-studio Jul 17, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants