Skip to content

fix(audit): escape LIKE wildcards in audit log search - #4392

Closed
89799969 wants to merge 1 commit into
apache:masterfrom
89799969:fix/audit-search-like-escape
Closed

89799969 wants to merge 1 commit into
apache:masterfrom
89799969:fix/audit-search-like-escape

Conversation

@89799969

Copy link
Copy Markdown
Contributor

Which Issue(s) This PR Fixes

Brief Description

GET /api/audit/logs, GET /api/audit/summary and the export path pass the search box value to a SQL LIKE across operator, resource_name and detail without escaping. % and _ therefore keep their wildcard meaning:

  • search=% matches every audit row
  • search=_ matches every non-empty value
  • a resource name containing _ matches unintended rows

Add a shared SqlLikeUtil (escape + explicit ESCAPE '\\' clause, H2-compatible) and use it in MybatisPlusAuditRepository.applyFilters, the single filter builder shared by the paged list, summary and export.

How Did You Test This Change?

$ cd server && mvn -B -ntp test -Dtest='SqlLikeUtilTest,MybatisPlusAuditRepositoryTest'
Tests run: 18, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

New tests:

  • SqlLikeUtilTest pins escape order and the explicit ESCAPE clause
  • findPageShouldEscapeLikeWildcardsInSearchTest asserts the bound pattern is %100\%\_done%
  • summarizeShouldEscapeLikeWildcardsInSearchTest asserts the summary path uses the same escaped pattern

Checklist

  • One coherent change; unrelated modifications are not bundled in
  • Commit subject follows Conventional Commits (fix:)
  • Tests added or updated, test methods named ...Test
  • No new UI text
  • Architecture constraints stay green
  • New source files carry the ASF license header
  • Documentation not required (search semantics fix)

The audit list, summary and export pass the search box value to a
LIKE pattern across operator, resource_name and detail without
escaping. Searching for % matches every row; underscores in resource
names act as single-character wildcards.

Add a shared SqlLikeUtil and apply an explicit ESCAPE clause so the
pattern is literal on both MySQL and H2.

Fixes apache#4289
@89799969

Copy link
Copy Markdown
Contributor Author

Closing in favour of #4458, which covers the audit LIKE escape as part of the full Studio search domain (auth, ACL, alert, audit, instance, credentials) and adds the explicit ESCAPE CHAR(92) clause this PR did not. Keeping both open only splits review.

@89799969 89799969 closed this Sep 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Studio][Bug] The audit log search treats % and _ as LIKE wildcards

1 participant