tju-yxq opened a new pull request, #1423: URL: https://github.com/apache/rocketmq-dashboard/pull/1423
## What is the purpose of the change Fixes #1422 The SSRF guard in `SettingsService.isAllowedDataSourceHost()` blocked `"localhost"` by string comparison but did not check `isLoopbackAddress()`. This allowed `127.0.0.1` to bypass the guard, enabling authenticated users to port-scan and access internal services on the Studio server's loopback interface. ## Brief changelog - **`SettingsService.java`**: Added `!address.isLoopbackAddress()` to the SSRF guard condition. ## Verifying this change 1. Try testing a data source with URL `http://127.0.0.1:8080/`. 2. Before fix: the test proceeds (SSRF bypass). 3. After fix: the test is rejected with "Data source URL must not point to a local or private address". - [x] Make sure there is a Github issue filed for the change. - [x] Format the pull request title like `[ISSUE #1422] ...`. - [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why. - [x] Write necessary unit-test to verify your logic correction. - [x] Run `mvn -B clean apache-rat:check findbugs:findbugs checkstyle:checkstyle` to make sure basic checks pass. - [ ] If this contribution is large, please file an Apache Individual Contributor License Agreement. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
