Aias00 opened a new issue, #1685: URL: https://github.com/apache/rocketmq-dashboard/issues/1685
## Problem The SSRF guard for Metrics data sources validates the configured URL, but runtime Prometheus-compatible queries use `AbstractPrometheusCompatibleMetricsSource` with the default `SimpleClientHttpRequestFactory`. That factory follows HTTP redirects, so a validated external data-source URL can redirect a runtime query to a loopback, link-local, or private endpoint. This is distinct from #1609, which covered the settings test-connection request path only. ## Evidence `server/src/main/java/org/apache/rocketmq/studio/cluster/metrics/AbstractPrometheusCompatibleMetricsSource.java` creates the request factory without disabling redirects. All Prometheus-compatible query implementations use this client. ## Scope - Disable redirect following for runtime metrics HTTP requests. - Add a regression test using an HTTP 302 response to verify the query does not reach the redirected endpoint. - Preserve existing timeout and structured-error behavior. ## Track Track 1 / Metrics data-source security. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
