RockteMQ-AI commented on code in PR #2339:
URL:
https://github.com/apache/rocketmq-dashboard/pull/2339#discussion_r3801316834
##########
server/src/main/java/org/apache/rocketmq/studio/provider/apache/RocketMQMessageProvider.java:
##########
@@ -170,6 +171,51 @@ private MessageExt viewMessageByOffsetId(DefaultMQAdminExt
adminExt, String topi
}
}
+ private String validatedBrokerAddr(DefaultMQAdminExt adminExt, String
msgId, MessageId messageId) throws Exception {
Review Comment:
**[Info]** `validatedBrokerAddr` correctly rejects decoded broker addresses
that are not in the known broker topology — a clean SSRF mitigation for the
offset-based message view path. The `knownBrokerEndpoints` cache (keyed by
adminExt instance) is a good optimization to avoid repeated cluster-info
queries within the same request scope.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
