acl不起作用，只要在topic前加$就能订阅

aibuliu · 2025 年8 月 23 日 01:54

acl

{allow, {username, {re, "^dashboard$"}}, subscribe, ["$SYS/#"]}.

{deny, all, subscribe, ["$SYS/#", {eq, "#"}, {eq, "+/#"}]}.
{deny, all}.

clientid: aab/ccc
username: deviceKey001

重启emqx了。
testtopic/# 不能订阅，但在前面加$，变成$testtopic/#就能订阅了。
不是应该都不能订阅吗？

zhongwencool · 2025 年8 月 25 日 08:54

确实有这个问题，反馈一下，在这里跟进：

github.com/emqx/emqx

ACL engine does not deny rule for topics prefixed with '$'

opened 08:53AM - 25 Aug 25 UTC

zhongwencool

BUG

### What happened? The ACL engine does not correctly apply deny rules to topics… prefixed with a dollar sign ($), even when these topics are not standard system topics (like $SYS). A catch-all `{deny, all}.` rule at the end of acl.conf should block all subscriptions not explicitly allowed. This works for `testtopic/#` but fails for `$testtopic/#`, allowing the subscription when it should be denied. Steps to reproduce: 1. Configure the following rules in acl.conf: - `{allow, {username, {re, "^dashboard$"}}, subscribe, ["$SYS/#"]}`. - `{deny, all, subscribe, ["$SYS/#", {eq, "#"}, {eq, "+/#"}]}`. - `{deny, all}`. 2. Restart the EMQX broker to ensure ACL rules are loaded. 3. Connect an MQTT client with: - Username: deviceKey001 - Client ID: aab/ccc 4. Attempt to subscribe to `testtopic/#` (correctly denied). 5. Attempt to subscribe to `$testtopic/#` (incorrectly allowed). ### What did you expect to happen? The MQTT client's subscription request to `$testtopic/#` should be denied by the final `{deny, all}.` rule, just like the subscription to `testtopic/#` is. ### How can we reproduce it (as minimally and precisely as possible)? See above in 'What happened?' for step-by-step reproduction instructions. ### Anything else we need to know? This behavior seems to be an inconsistency in how ACLs are evaluated for user-defined topics prefixed with `$` and could be a potential security loophole. ### EMQX version 5.10.0 ### OS version Ubuntu 22.04 ### Log files _No response_