youngkermit8-coder opened a new issue, #2036:
URL: https://github.com/apache/rocketmq-dashboard/issues/2036

   ## Security bug\n\nStudio has two write paths for the LLM base URL:\n\n- 
POST /api/llm/config delegates to LlmConfigService.saveConfig, which validates 
the URL and applies UrlHostGuard.\n- POST /api/settings/general/save delegates 
directly to SettingsService.saveGeneralSettings, which currently persists 
GeneralSettingsVO.baseUrl without applying the shared guard.\n\nThe second path 
therefore bypasses the protection added to the dedicated LLM configuration API. 
A URL pointing at a link-local/cloud-metadata address can be stored through 
general settings and later used by server-side AI requests.\n\n## 
Reproduction\n\n1. Build a valid GeneralSettingsVO with 
aseUrl=http://169.254.169.254/latest/meta-data.\n2. Call 
SettingsService.saveGeneralSettings.\n3. The repository receives and persists 
the value; no validation error is raised.\n4. LlmConfigService.getConfig later 
reads that persisted base URL for the runtime LLM configuration.\n\nThe same 
value is rejected when sent through /api
 /llm/config, so the behavior depends on which public settings endpoint is 
used.\n\n## Expected behavior\n\nEvery persistence path for an LLM base URL 
should apply the shared URL guard before writing settings. Link-local and 
metadata endpoints must be rejected with a stable 400-level business error, 
while supported local Ollama loopback URLs must remain allowed.\n\n## Proposed 
scope\n\n- Validate GeneralSettingsVO.baseUrl in 
SettingsService.saveGeneralSettings with UrlHostGuard and 
llowLoopback=true.\n- Convert guard failures to a stable 
BusinessException(400, ...).\n- Add regression coverage proving metadata URLs 
are rejected before repository writes and local Ollama URLs remain valid.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to