LuciferYang opened a new issue, #11784: URL: https://github.com/apache/gravitino/issues/11784
### What would you like to be improved? `FileFetcher` validates a remote URI's host against an SSRF denylist before downloading keytabs/jars, but the download step then re-resolves the hostname when it opens the connection. The DNS answer can change between the two steps (DNS rebinding / TOCTOU), so a host that passed validation can still connect to an internal or cloud-metadata address. A few related gaps make it worse: - the denylist misses some address forms (0.0.0.0/8, CGNAT 100.64/10, the Alibaba/Oracle metadata IPs, broadcast, IPv6 unique-local, and IPv4 addresses embedded in IPv6 literals); - FTP's PASV data channel connects to an address the server chooses, which can't be pinned; - credential-bearing URIs (userinfo, presigned query tokens) are logged verbatim. ### How should we improve? - Resolve the host once, validate every resolved address, and pin the download to the validated address so the hostname is never looked up again. - Extend the denylist to the forms above, including IPv4-compatible/mapped/NAT64/6to4/ISATAP embeddings. - Reject FTP when unsafe-URI blocking is on (the default); operators can opt out for trusted sources. - Strip userinfo and query strings from URIs before they reach logs or error messages. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
