Aias00 opened a new issue, #1685:
URL: https://github.com/apache/rocketmq-dashboard/issues/1685

   ## Problem
   
   The SSRF guard for Metrics data sources validates the configured URL, but 
runtime Prometheus-compatible queries use 
`AbstractPrometheusCompatibleMetricsSource` with the default 
`SimpleClientHttpRequestFactory`. That factory follows HTTP redirects, so a 
validated external data-source URL can redirect a runtime query to a loopback, 
link-local, or private endpoint.
   
   This is distinct from #1609, which covered the settings test-connection 
request path only.
   
   ## Evidence
   
   
`server/src/main/java/org/apache/rocketmq/studio/cluster/metrics/AbstractPrometheusCompatibleMetricsSource.java`
 creates the request factory without disabling redirects. All 
Prometheus-compatible query implementations use this client.
   
   ## Scope
   
   - Disable redirect following for runtime metrics HTTP requests.
   - Add a regression test using an HTTP 302 response to verify the query does 
not reach the redirected endpoint.
   - Preserve existing timeout and structured-error behavior.
   
   ## Track
   
   Track 1 / Metrics data-source security.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to