youngkermit8-coder opened a new pull request, #1510: URL: https://github.com/apache/rocketmq-dashboard/pull/1510
## What is the purpose of the change Fixes #1509. The data-source connection test rejects the IPv4 cloud metadata range, but Java does not classify the AWS IMDS IPv6 endpoint (`fd00:ec2::254`) as any-local, link-local, loopback, or site-local. The documented AWS metadata endpoint therefore passed the existing SSRF guard. ## Brief changelog - Reject the exact 16-byte AWS IMDS IPv6 address after hostname resolution. - Compare the binary address so compressed and expanded IPv6 forms are handled identically. - Add regression coverage for both IPv6 text forms. - Keep ordinary private/site-local addresses allowed for on-premise Prometheus deployments. AWS references: - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-limiting-access.html ## Verifying this change Validated on JDK 21 with #1502 applied in an isolated clean worktree: ```text mvn -B -ntp validate Checkstyle: 0 violations mvn -B -ntp -Dtest=SettingsServiceTest#testConnectionShouldRejectAwsImdsIpv6Address test Tests run: 1, Failures: 0, Errors: 0, Skipped: 0 BUILD SUCCESS ``` The clean build compiled all 374 main sources and 109 test sources. Running the entire existing `SettingsServiceTest` currently exposes seven unrelated base failures because its local HTTP fixture still uses `127.0.0.1`, which #1423 now rejects; the new regression test itself passes and does not use the network. - [x] A GitHub issue is filed for the change. - [x] The PR is scoped to one security hardening fix. - [x] Regression tests and Signed-off-by are included. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
