youngkermit8-coder opened a new pull request, #1556: URL: https://github.com/apache/rocketmq-dashboard/pull/1556
## Summary - resolve every address returned for a data-source hostname; - allow the connection test only when every resolved address passes the existing SSRF policy; - reject mixed public/loopback results instead of depending on DNS answer ordering; - add focused regression coverage for mixed and all-safe address sets. ## Root cause `SettingsService.isAllowedDataSourceHost` used `InetAddress.getByName`, so it validated only one address even when a hostname had several DNS answers. The HTTP client resolves the hostname independently and may select or retry a different answer, allowing a prohibited result to escape the preflight check. ## Impact Data-source connection tests now fail closed when any resolved address is any-local, link-local, or loopback. Legitimate on-premises private addresses and the existing unresolvable-host connectivity error behavior are unchanged. ## Validation The base branch currently needs the unrelated compilation fix from #1502. In an isolated worktree with #1502 applied: - two new `SettingsServiceTest` cases passed; - Checkstyle reported 0 violations; - the Spring Boot package build succeeded. Compatibility was also validated on a combined isolated tree containing #1502, #1512, the latest #1510, and this change: - `SettingsServiceTest`: 33 tests passed; - Checkstyle reported 0 violations; - the Spring Boot package build succeeded. Closes #1543 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
