psxjoy opened a new pull request, #1035: URL: https://github.com/apache/fesod/pull/1035
## Purpose of the pull request Make remote URL image fetching explicit and fail closed. This PR requires callers to configure exact trusted hosts before `UrlImageConverter` performs any outbound request. ## What's changed? - Add an exact-host `allowedHosts(...)` policy and disable remote URL image fetching when the allowlist is empty. - Normalize domain names, internal hostnames, IDNs, trailing dots, and IPv6 literals consistently. - Reject wildcards, URL components, user info, whitespace, and invalid host entries. - Validate the allowlist before DNS resolution and revalidate every redirect target. - Keep private-host and private-CIDR authorization as an additional security boundary. - Match hosts independently of URL ports. - Update the English and Chinese URL image documentation. - Add focused tests for default-deny behavior, exact-host matching, redirects, private-network authorization, and invalid configurations. The default-deny behavior is an intentional security hardening. Applications that use remote URL images must explicitly configure their trusted hosts. ## Verification - `./mvnw -pl fesod-sheet -Dmaven.test.skip=false -Dtest=UrlImageFetchPolicyTest,UrlImageConverterTest spotless:check test` - 16 focused tests passed. - English and Chinese documentation passed Markdownlint. ## Checklist - [ ] I have read the [Contributor Guide](https://fesod.apache.org/community/contribution/). - [x] I have written the necessary doc or comment. - [x] I have added the necessary unit tests and all cases have passed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
