yuqi1129 commented on code in PR #11354:
URL: https://github.com/apache/gravitino/pull/11354#discussion_r3380320883
##########
core/src/test/java/org/apache/gravitino/job/TestJobManager.java:
##########
@@ -914,6 +933,71 @@ public void
testFetchFileFromUriWithMissingLocalFileShouldFail() throws IOExcept
RuntimeException.class, () -> JobManager.fetchFileFromUri(uri,
stagingDir, 1000));
}
+ @Test
+ public void testFetchFileFromUriSsrfBlocked() {
+ File stagingDir = new File(testStagingDir);
+ Assertions.assertTrue(stagingDir.mkdirs() || stagingDir.exists());
+
+ // Loopback address
+ RuntimeException e1 =
+ Assertions.assertThrows(
+ RuntimeException.class,
+ () -> JobManager.fetchFileFromUri("http://127.0.0.1:8090/configs";,
stagingDir, 1000));
+ assertRemoteUriBlockedMessage(e1);
+
+ // AWS / GCP / Azure cloud-metadata endpoint (link-local 169.254.x.x)
+ RuntimeException e2 =
+ Assertions.assertThrows(
+ RuntimeException.class,
+ () ->
+ JobManager.fetchFileFromUri(
+ "http://169.254.169.254/latest/meta-data/";, stagingDir,
1000));
+ assertRemoteUriBlockedMessage(e2);
+
+ // RFC-1918 private range
+ RuntimeException e3 =
+ Assertions.assertThrows(
+ RuntimeException.class,
+ () -> JobManager.fetchFileFromUri("http://192.168.1.1/";,
stagingDir, 1000));
+ assertRemoteUriBlockedMessage(e3);
+
+ // Alibaba Cloud / Oracle Cloud metadata endpoint
+ RuntimeException e4 =
+ Assertions.assertThrows(
+ RuntimeException.class,
+ () -> JobManager.fetchFileFromUri("http://100.100.100.200/";,
stagingDir, 1000));
+ assertRemoteUriBlockedMessage(e4);
+ }
+
+ @Test
+ public void testFetchFileFromUriShouldAllowLocalhostWhenBlockingDisabled()
throws Exception {
+ File stagingDir = new File(testStagingDir);
+ Assertions.assertTrue(stagingDir.mkdirs() || stagingDir.exists());
+ HttpServer server = createLoopbackHttpServer("job artifact");
+
+ try {
+ server.start();
+ int port = server.getAddress().getPort();
+
+ String fetchedFile =
+ JobManager.fetchFileFromUri(
+ String.format("http://127.0.0.1:%d/artifact.jar";, port),
stagingDir, 1000, false);
+
+ Assertions.assertEquals("job artifact",
Files.readString(Path.of(fetchedFile)));
+ } finally {
+ server.stop(0);
+ }
+ }
Review Comment:
Updated the PR description to reference `TestRemoteUriValidator` for URI
validation coverage and `TestJobManager` for JobManager download behavior. The
description now also reflects the shared `FetchFileUtils` consolidation and
configuration changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
