fix(alert): escape LIKE wildcards in rule name and metric search

[89799969]

What is the purpose of the change

Fixes #4232.

Alert-rule inventory search treats % and _ as SQL LIKE wildcards instead of literal characters:

• GET /api/alert-rules/page?search= / GET /api/business-alert-rules/page?search= filter name with unescaped LIKE (MybatisPlusAlertRepository.ruleQuery).
• Domain-scoped paging (AlertRuleQuery.search) filters name and metric the same way (MybatisPlusAlertRepository.findRulesPage).

Alert-rule names and metric identifiers commonly contain underscores (consumer_lag, disk_usage). Searching for consumer_lag therefore also matches consumerXlag, and a trailing % matches any suffix — so the inventory silently returns unrelated rules or hides the intended one.

Brief changelog

• Add a private escapeLike helper (same behaviour as the existing QueryHistoryService.escapeLike) and apply it to the legacy name-only page search and the domain page name/metric search.
• Two regression tests assert the bound LIKE value for prod_lag% / consumer_lag% is escaped (%prod\_lag\%%) rather than treated as a wildcard pattern.

Verifying this change

$ mvn -f server/pom.xml test -Dtest='Alert*Test,MybatisPlusAlertRepositoryTest'
[INFO] Tests run: 198, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS

Checkstyle: 0 violations (module validate phase).

Before the fix the two new tests fail because the bound parameters are %prod_lag% / %consumer_lag%; after it they bind %prod\_lag\%% / %consumer\_lag\%%.

Related peers: #4229/#4230 (ACL inventory), #4223/#4224 (Studio user search), #4192–#4194 (audit / instance / cloud-credential LIKE escape).

[RockteMQ-AI]

Summary

Clean fix for SQL LIKE wildcard injection in alert-rule search. The escapeLike helper correctly escapes \, %, and _ in the right order (backslash first to avoid double-escaping), and the unit tests verify both positive (escaped chars present in query) and negative (unescaped values absent) cases.

Findings

• [Info] MybatisPlusAlertRepository.java:371 — The escapeLike method is duplicated across multiple repositories in this codebase (see also QueryHistoryService.escapeLike, MybatisPlusAclRepository.escapeLike, AuthService.escapeLike). Consider extracting to a shared utility class (e.g. SqlLikeEscape) to reduce drift risk.

LGTM — good fix with solid test coverage.

[lizhimins]

Same single item as on #4224 and #4230: replace the private escapeLike copy with the shared utility in common/util, and add an explicit ESCAPE clause rather than relying on MySQL's implicit backslash (H2, used by five tests in this suite, has no default LIKE escape character). Please keep the tests.

[89799969]

Same mechanical fix as requested on #4224/#4230: shared SqlLikeUtil + explicit ESCAPE clause. Tests kept.

[89799969]

@lizhimins Following up - shared SqlLikeUtil + explicit ESCAPE is pushed (6f89b257) and this branch is MERGEABLE/CLEAN on current rocketmq-studio. Ready for re-review.

[RockteMQ-AI]

LGTM. Code changes look good.

---

Automated review by github-manager-bot