yyqdbngt opened a new pull request, #1974: URL: https://github.com/apache/rocketmq-dashboard/pull/1974
## What is the purpose of the change `UrlHostGuard.isAllowedHost` resolved the host with `InetAddress.getByName`, which only returns the **first** DNS record. A host with multiple A/AAAA records (round-robin or wildcard DNS) can point both at a public address and at loopback / link-local / cloud-metadata addresses; the guard would see the public record, allow the host, and the HTTP client's independent resolution could then connect to the internal address. The same class of issue was already fixed for data sources in #1556, but the shared `UrlHostGuard` was left behind. ## Brief changelog - Resolve all addresses with `InetAddress.getAllByName` and reject the host when *any* resolved address is any-local, link-local, or loopback (when loopback is not allowed), matching `SettingsService.areAllowedDataSourceAddresses`. - Add a `UrlHostGuardTest` covering loopback gating, link-local/any-local rejection, public endpoints, and unresolvable hosts. ## Verifying this change - `mvn -q -Dtest=UrlHostGuardTest test` - `mvn -q test` (1056/1056) - `git diff --check` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
