[Bug] Proxy gRPC ack accepts empty entries until IndexOutOfBoundsException

[Aias00]

Before Creating the Bug Report

• I have searched the existing issues and pull requests.

Runtime platform environment

All platforms.

RocketMQ version

develop branch.

JDK Version

Not applicable.

Describe the Bug

AckMessageActivity.ackMessage reads the first ack entry before validating that the request contains any entries:

boolean isBatchAck = ConfigurationManager.getProxyConfig().isEnableBatchAck()
    && !request.getEntries(0).hasLiteTopic();

If a gRPC client sends an AckMessageRequest with an empty entries list, this path throws an IndexOutOfBoundsException. That makes an invalid client request look like an internal Proxy failure instead of a structured gRPC bad-request response.

Steps to Reproduce

1. Send an AckMessageRequest with valid topic and group, but no entries.
2. Let Proxy handle the request through AckMessageActivity.ackMessage.
3. request.getEntries(0) is evaluated before entry-count validation.

What Did You Expect to See?

Proxy should reject the request with a structured client-side error, for example GrpcProxyException(Code.BAD_REQUEST, "ack message entries cannot be empty").

What Did You See Instead?

Proxy throws IndexOutOfBoundsException while trying to access the first entry.

Additional Context

This is a small gRPC Proxy request validation hardening issue. It keeps invalid client input from surfacing as an internal server error and makes the behavior easier for clients and operators to diagnose.

[RockteMQ-AI]

Issue Evaluation

Category: type/bug | Status: Confirmed

The missing empty-entries validation in AckMessageActivity.ackMessage has been verified against the current develop branch.

Root Cause: AckMessageActivity.java:57 accesses request.getEntries(0) to determine batch-ack mode before any validation that the entries list is non-empty. When a gRPC client sends an AckMessageRequest with zero entries, this throws IndexOutOfBoundsException instead of returning a structured BAD_REQUEST error.

Impact: Invalid client requests surface as internal Proxy errors (500-class) rather than client-side errors (400-class), making diagnosis harder for operators and clients.

Severity: Medium — no data corruption, but incorrect error semantics and noisy error logs.

Suggested fix: Add an entries-empty check before line 57, returning GrpcProxyException(Code.BAD_REQUEST, "ack message entries cannot be empty").

An automated fix proposal will be generated. Reply /approve to proceed with PR generation.

---

Automated evaluation by github-manager-bot