youngkermit8-coder opened a new issue, #2036: URL: https://github.com/apache/rocketmq-dashboard/issues/2036
## Security bug\n\nStudio has two write paths for the LLM base URL:\n\n- POST /api/llm/config delegates to LlmConfigService.saveConfig, which validates the URL and applies UrlHostGuard.\n- POST /api/settings/general/save delegates directly to SettingsService.saveGeneralSettings, which currently persists GeneralSettingsVO.baseUrl without applying the shared guard.\n\nThe second path therefore bypasses the protection added to the dedicated LLM configuration API. A URL pointing at a link-local/cloud-metadata address can be stored through general settings and later used by server-side AI requests.\n\n## Reproduction\n\n1. Build a valid GeneralSettingsVO with aseUrl=http://169.254.169.254/latest/meta-data.\n2. Call SettingsService.saveGeneralSettings.\n3. The repository receives and persists the value; no validation error is raised.\n4. LlmConfigService.getConfig later reads that persisted base URL for the runtime LLM configuration.\n\nThe same value is rejected when sent through /api /llm/config, so the behavior depends on which public settings endpoint is used.\n\n## Expected behavior\n\nEvery persistence path for an LLM base URL should apply the shared URL guard before writing settings. Link-local and metadata endpoints must be rejected with a stable 400-level business error, while supported local Ollama loopback URLs must remain allowed.\n\n## Proposed scope\n\n- Validate GeneralSettingsVO.baseUrl in SettingsService.saveGeneralSettings with UrlHostGuard and llowLoopback=true.\n- Convert guard failures to a stable BusinessException(400, ...).\n- Add regression coverage proving metadata URLs are rejected before repository writes and local Ollama URLs remain valid. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
