youngkermit8-coder opened a new pull request, #1516: URL: https://github.com/apache/rocketmq-dashboard/pull/1516
## What is the purpose of the change Closes #1515. Data source connection tests validate the initially configured URL, but the underlying `HttpURLConnection` follows redirects by default. A validated public endpoint could therefore redirect the request to a loopback, private-network, or cloud metadata address and bypass the SSRF address checks. ## Brief changelog - Add a dedicated `SimpleClientHttpRequestFactory` that disables per-connection redirect following. - Keep the existing connect/read timeouts and initial URL validation unchanged. - Treat a redirect response as the remote endpoint's response instead of issuing an unvalidated follow-up request. - Add a regression test proving redirects are disabled when each connection is prepared. ## Verification - On top of #1502, `DataSourceClientHttpRequestFactoryTest`: 1 test passed. - On top of #1502 plus #1512, `DataSourceClientHttpRequestFactoryTest,SettingsServiceTest`: 30 tests passed. - `mvn clean package`: passed on the combined branch. - Checkstyle: 0 violations. ## Notes This change and #1512 both touch the request-factory construction line. Their behavior is compatible; the combined verification used `DataSourceClientHttpRequestFactory` inside #1512's extracted `buildDataSourceRestClient` method. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
