apache / apache/rocketmq-dashboard

[Studio][Bug] Alert-rule search does not escape SQL LIKE wildcards

Open
#4,232 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.4k
Forks
683
Avg merge
2d 14h
Merged PRs (30d)
58

Description

## Problem

Alert-rule inventory search treats `%` and `_` as SQL LIKE wildcards instead of literal characters:

- `GET /api/alert-rules/page?search=` / `GET /api/business-alert-rules/page?search=` filter `name` with unescaped `LIKE` (`MybatisPlusAlertRepository.ruleQuery`).
- Domain-scoped paging (`AlertRuleQuery.search`, used by the paged alert-rule feed) filters `name` and `metric` the same way (`MybatisPlusAlertRepository.findRulesPage`).

Alert-rule names and metric identifiers commonly contain underscores (`consumer_lag`, `disk_usage`). Searching for `consumer_lag` therefore also matches `consumerXlag`, and a trailing `%` matches any suffix — so the inventory silently returns unrelated rules or hides the intended one.

## Evidence

`MybatisPlusAlertRepository.ruleQuery` (`server/src/main/java/org/apache/rocketmq/studio/ops/alert/MybatisPlusAlertRepository.java:75-80`) passes the search term straight into `.like(name, search)`.

`MybatisPlusAlertRepository.findRulesPage` (`:83-101`) does the same for both `name` and `metric` after only trimming the term.

The same class of defect was already fixed for query history (`QueryHistoryService.escapeLike`) and is being fixed for ACL inventory (#4229 / #4230), Studio user search, instance / audit / cloud-credential search; alert-rule search is the remaining high-traffic search surface with the gap.

## Impact

Operators cannot reliably look up the alert rule they mean when the name or metric contains `_` or `%`. In a shared Studio with many rules this produces wrong rows and can hide the intended rule.

## Expected behavior

User-supplied `search` terms are matched literally. Escape `\`, `%`, and `_` before building the LIKE pattern (same convention as `QueryHistoryService.escapeLike`). Blank/null filters keep their current no-filter semantics.

## Acceptance criteria

- Regression tests prove a term such as `consumer_lag%` is bound as `%consumer\_lag\%%` rather than `%consumer_lag%`.
- Cover both the legacy name-only page search and the domain page name/metric search.
- Do not change the public API contract.

## Related work

#2265 / `QueryHistoryService.escapeLike` established the escape convention. Open peers: #4229/#4230 (ACL inventory), #4223/#4224 (Studio user search), instance / audit / cloud-credential LIKE PRs.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in server/src/main/java/org/apache/rocketmq/studio/ops/alert/MybatisPlusAlertRepository.java, reading ruleQuery and findRulesPage, then compare QueryHistoryService.escapeLike. Add regression coverage for the legacy name-only search and domain name/metric search; done means wildcard terms are bound literally while blank and null searches retain their current behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, sql
Domain
api, backend, databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
75/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.