LuciferYang opened a new issue, #11784:
URL: https://github.com/apache/gravitino/issues/11784

   ### What would you like to be improved?
   
   `FileFetcher` validates a remote URI's host against an SSRF denylist before 
downloading keytabs/jars, but the download step then re-resolves the hostname 
when it opens the connection. The DNS answer can change between the two steps 
(DNS rebinding / TOCTOU), so a host that passed validation can still connect to 
an internal or cloud-metadata address. A few related gaps make it worse:
   
   - the denylist misses some address forms (0.0.0.0/8, CGNAT 100.64/10, the 
Alibaba/Oracle metadata IPs, broadcast, IPv6 unique-local, and IPv4 addresses 
embedded in IPv6 literals);
   - FTP's PASV data channel connects to an address the server chooses, which 
can't be pinned;
   - credential-bearing URIs (userinfo, presigned query tokens) are logged 
verbatim.
   
   ### How should we improve?
   
   - Resolve the host once, validate every resolved address, and pin the 
download to the validated address so the hostname is never looked up again.
   - Extend the denylist to the forms above, including 
IPv4-compatible/mapped/NAT64/6to4/ISATAP embeddings.
   - Reject FTP when unsafe-URI blocking is on (the default); operators can opt 
out for trusted sources.
   - Strip userinfo and query strings from URIs before they reach logs or error 
messages.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to