[BUG] — `operation_record_log.selectByCondition`: unbounded audit-log scan, leading-wildcard LIKE on TEXT, no pagination, no index
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: High; files: `mappers/operation-record-log-sqlmap.xml:70-88`; service `OperationRecordLogServiceImpl.java:58-61` (returns raw list, no paging)
- description: `context like concat('%',#{keyword},'%')` and `context not like concat('%',#{excluded},'%')` on a TEXT column; `operation_record_log` schema (`schema.sql:357-365`) defines no index on `operation_time` or `operator`; no `LIMIT`.
- impact: A wide time-range query scans and sorts the entire audit log; latency/temp-space grows with table size.
- suggested_fix: Add index on `(operation_time, operator)`; add `LIMIT`/`@Pageable`; use full-text or a generated prefix index instead of `'%kw%'`.
- confidence: High
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with mappers/operation-record-log-sqlmap.xml:70-88 and OperationRecordLogServiceImpl.java:58-61, then inspect schema.sql:357-365 and the consolidated scan report. Reproduce the wide time-range audit-log query and measure its scan, sort, and result size. Done means the query is bounded and indexed appropriately, pagination works, and performance is verified without changing the requested audit-log behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, sql
- Domain
- backend, databases, performance
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100