User is able to publish/subscribe to the topic that they not allow when they subscribe '#' topic. about emqx

[lafirest]

Hi, @sambatlim, I don't think this is a bug since the # means to match all of the topics.
And if possible, please paste your rules here, thanks

[ieQu1]

What is the value of authorization.no_match config parameter?
https://www.emqx.io/docs/en/latest/access-control/authz/authz.html#configure-with-configuration-file

If it's allow, then the broker will allow the clients to subscribe to any topic not covered by a deny rule. So the ACL works in blocklist mode.
If you want to use ACL in allowlist mode, you should set this parameter to deny.

[arno608rw]

[sambatlim]

@lafirest The rules are as the images from @arno608rw

[zmstone]

I guess the default 'file' source is enabled?
The default 'file' authz source allows subscribing to # when the client is from 127.0.0.1 (given in the screenshot it's 'localhost' used).

[arno608rw]

I guess the default 'file' source is enabled? The default 'file' authz source allows subscribing to # when the client is from 127.0.0.1 (given in the screenshot it's 'localhost' used).

I Disable Authorization on File

[zmstone]

Thank you @savonarola for taking it, FYI. I cannot reproduce this.

[savonarola]

Hello! I couldn't reproduce either.

I expect user-01 to see only the message from the topic that they allowed when subscribe to '#'.

With the specified settings none of the user should be allowed to subscribe to '#' at all. But after they subscribed to the topic and before session recreation, the ACL is not checked anymore for receiving.

However, from the specified screenshots of MQTT Explorer, it is impossible to see which messages were actually sent and received.

Received messages (if any) should be displayed near the host

Could you reproduce the issue (ability to subscribe to '#') with some terminal client, like mosquitto_pub & mosquitto_sub?

Like, subscribe to '#' in the terminal:

>mosquitto_sub -d -t '#' -q 1 -u user-01 -P password
Client (null) sending CONNECT
Client (null) received CONNACK (0)
Client (null) sending SUBSCRIBE (Mid: 1, Topic: #, QoS: 1, Options: 0x00)
Client (null) received SUBACK
Subscribed (mid: 1): 1
Client (null) received PUBLISH (d0, q0, r1, m0, '$SYS/brokers', ... (14 bytes))
[email protected]
Client (null) received PUBLISH (d0, q0, r1, m0, '$SYS/brokers/[email protected]/sysdescr', ... (15 bytes))
EMQX Enterprise
Client (null) received PUBLISH (d0, q0, r1, m0, '$SYS/brokers/[email protected]/version', ... (5 bytes))
5.4.1