youngkermit8-coder opened a new issue, #1515:
URL: https://github.com/apache/rocketmq-dashboard/issues/1515

   ## Bug Report
   
   ### Environment
   
   - Branch: `rocketmq-studio`
   - JDK: 21
   
   ### Description
   
   `SettingsService` validates only the user-supplied data-source host before 
issuing its server-side Prometheus request. The service uses 
`SimpleClientHttpRequestFactory`, which delegates GET requests to 
`HttpURLConnection`; automatic redirect following is enabled by default on JDK 
21.
   
   An allowed public URL can therefore respond with a redirect to a host that 
the SSRF guard would reject if supplied directly, such as loopback or a cloud 
metadata endpoint. The redirected destination is followed by the HTTP layer 
without passing through `isAllowedDataSourceHost()`.
   
   JDK 21 reproduction:
   
   ```text
   HttpURLConnection.getFollowRedirects() == true
   connection.getInstanceFollowRedirects() == true
   ```
   
   ### Expected behavior
   
   The data-source connection test must not automatically follow redirects to 
an unvalidated destination. A redirect response should make the connection test 
fail without issuing the redirected request.
   
   ### Proposed scope
   
   - Use a dedicated `SimpleClientHttpRequestFactory` subclass that disables 
instance-level redirect following after Spring prepares the connection.
   - Keep the existing connect/read timeouts and initial host validation 
unchanged.
   - Add a deterministic unit test proving the prepared connection has 
redirects disabled without making a network request.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to