apache / apache/rocketmq-dashboard
[Studio][Bug] Alert-rule search does not escape SQL LIKE wildcards
- Dominant language
- Java
- Stars
- 1.4k
- Forks
- 683
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 58
Description
## Problem
Alert-rule inventory search treats `%` and `_` as SQL LIKE wildcards instead of literal characters:
- `GET /api/alert-rules/page?search=` / `GET /api/business-alert-rules/page?search=` filter `name` with unescaped `LIKE` (`MybatisPlusAlertRepository.ruleQuery`).
- Domain-scoped paging (`AlertRuleQuery.search`, used by the paged alert-rule feed) filters `name` and `metric` the same way (`MybatisPlusAlertRepository.findRulesPage`).
Alert-rule names and metric identifiers commonly contain underscores (`consumer_lag`, `disk_usage`). Searching for `consumer_lag` therefore also matches `consumerXlag`, and a trailing `%` matches any suffix — so the inventory silently returns unrelated rules or hides the intended one.
## Evidence
`MybatisPlusAlertRepository.ruleQuery` (`server/src/main/java/org/apache/rocketmq/studio/ops/alert/MybatisPlusAlertRepository.java:75-80`) passes the search term straight into `.like(name, search)`.
`MybatisPlusAlertRepository.findRulesPage` (`:83-101`) does the same for both `name` and `metric` after only trimming the term.
The same class of defect was already fixed for query history (`QueryHistoryService.escapeLike`) and is being fixed for ACL inventory (#4229 / #4230), Studio user search, instance / audit / cloud-credential search; alert-rule search is the remaining high-traffic search surface with the gap.
## Impact
Operators cannot reliably look up the alert rule they mean when the name or metric contains `_` or `%`. In a shared Studio with many rules this produces wrong rows and can hide the intended rule.
## Expected behavior
User-supplied `search` terms are matched literally. Escape `\`, `%`, and `_` before building the LIKE pattern (same convention as `QueryHistoryService.escapeLike`). Blank/null filters keep their current no-filter semantics.
## Acceptance criteria
- Regression tests prove a term such as `consumer_lag%` is bound as `%consumer\_lag\%%` rather than `%consumer_lag%`.
- Cover both the legacy name-only page search and the domain page name/metric search.
- Do not change the public API contract.
## Related work
#2265 / `QueryHistoryService.escapeLike` established the escape convention. Open peers: #4229/#4230 (ACL inventory), #4223/#4224 (Studio user search), instance / audit / cloud-credential LIKE PRs.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in server/src/main/java/org/apache/rocketmq/studio/ops/alert/MybatisPlusAlertRepository.java, reading ruleQuery and findRulesPage, then compare QueryHistoryService.escapeLike. Add regression coverage for the legacy name-only search and domain name/metric search; done means wildcard terms are bound literally while blank and null searches retain their current behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, sql
- Domain
- api, backend, databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 75/100