Aias00 commented on issue #2338: URL: https://github.com/apache/rocketmq-dashboard/issues/2338#issuecomment-5323900925
Thanks for the review. This report targets the `rocketmq-studio` branch, not the repository default branch. The affected code is present there: - `server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyCompatController.java` exposes `POST /api/proxy/addProxyAddr.do`. - `server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyController.java` exposes `POST /api/proxies/config/reload`. - `ProxyAddressService.reloadConfig` constructs `http://<registered-address>/admin/reloadConfig` and performs the outbound POST. The prior registration validation only checked `host:port` syntax, so an administrator could register and invoke an arbitrary reachable target. The fix is available in PR #2340, based on `rocketmq-studio`: it resolves reload targets from the selected cluster's discovered Proxy endpoints instead of the mutable compatibility-address registry. All CI checks are passing. Please evaluate the report and PR against `rocketmq-studio`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
