yuqi1129 opened a new pull request, #11354: URL: https://github.com/apache/gravitino/pull/11354
### What changes were proposed in this pull request? Add host validation in `JobManager.fetchFileFromUri()` before issuing HTTP/HTTPS/FTP downloads. The new `validateRemoteUri()` method resolves the target hostname and rejects addresses in the following ranges: - Loopback (127.0.0.0/8, ::1) - Link-local (169.254.0.0/16, fe80::/10) - RFC-1918 private (10.x, 172.16-31.x, 192.168.x) - Multicast / unspecified - Cloud metadata endpoint 100.100.100.200 (Alibaba Cloud / Oracle Cloud) ### Why are the changes needed? `fetchFileFromUri()` previously passed user-supplied URIs directly to `FileUtils.copyURLToFile()` without inspecting the resolved IP. This allowed the server to be directed to fetch content from addresses it should never reach, such as internal services or cloud metadata endpoints. ### Does this PR introduce _any_ user-facing change? No. This only affects URIs that point to internal/private addresses, which were never a valid use case. ### How was this patch tested? Added `testFetchFileFromUriSsrfBlocked()` and `testValidateRemoteUri()` in `TestJobManager`, covering loopback, link-local, RFC-1918 private, localhost, and the Alibaba Cloud metadata endpoint. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
