youngkermit8-coder opened a new issue, #1515: URL: https://github.com/apache/rocketmq-dashboard/issues/1515
## Bug Report ### Environment - Branch: `rocketmq-studio` - JDK: 21 ### Description `SettingsService` validates only the user-supplied data-source host before issuing its server-side Prometheus request. The service uses `SimpleClientHttpRequestFactory`, which delegates GET requests to `HttpURLConnection`; automatic redirect following is enabled by default on JDK 21. An allowed public URL can therefore respond with a redirect to a host that the SSRF guard would reject if supplied directly, such as loopback or a cloud metadata endpoint. The redirected destination is followed by the HTTP layer without passing through `isAllowedDataSourceHost()`. JDK 21 reproduction: ```text HttpURLConnection.getFollowRedirects() == true connection.getInstanceFollowRedirects() == true ``` ### Expected behavior The data-source connection test must not automatically follow redirects to an unvalidated destination. A redirect response should make the connection test fail without issuing the redirected request. ### Proposed scope - Use a dedicated `SimpleClientHttpRequestFactory` subclass that disables instance-level redirect following after Spring prepares the connection. - Keep the existing connect/read timeouts and initial host validation unchanged. - Add a deterministic unit test proving the prepared connection has redirects disabled without making a network request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
