(rocketmq-dashboard) branch rocketmq-studio updated: fix(cluster): reject malformed NameServer addresses (#2745)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new 020fc3da6 fix(cluster): reject malformed NameServer addresses (#2745)
020fc3da6 is described below

commit 020fc3da6efef8c7e99ce939969f81acc905e39e
Author: btlqql <2977859...@qq.com>
AuthorDate: Wed Sep 2 17:11:53 2026 +0800

    fix(cluster): reject malformed NameServer addresses (#2745)
---
 .../studio/cluster/nameserver/NamesrvAddrParser.java   | 18 ++++--------------
 .../cluster/nameserver/NamesrvAddrParserTest.java      | 16 ++++++++++++++++
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/cluster/nameserver/NamesrvAddrParser.java
 
b/server/src/main/java/org/apache/rocketmq/studio/cluster/nameserver/NamesrvAddrParser.java
index e0fa94de8..a064f5969 100644
--- 
a/server/src/main/java/org/apache/rocketmq/studio/cluster/nameserver/NamesrvAddrParser.java
+++ 
b/server/src/main/java/org/apache/rocketmq/studio/cluster/nameserver/NamesrvAddrParser.java
@@ -17,6 +17,7 @@
 package org.apache.rocketmq.studio.cluster.nameserver;
 
 import org.apache.rocketmq.studio.common.exception.BusinessException;
+import org.apache.commons.validator.routines.InetAddressValidator;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -31,6 +32,7 @@ public final class NamesrvAddrParser {
 
     private static final int MIN_PORT = 1;
     private static final int MAX_PORT = 65535;
+    private static final InetAddressValidator ADDRESS_VALIDATOR = 
InetAddressValidator.getInstance();
 
     private NamesrvAddrParser() {
     }
@@ -40,7 +42,7 @@ public final class NamesrvAddrParser {
             throw new BusinessException(400, "namesrvAddr must not be blank");
         }
         List<String> segments = new ArrayList<>();
-        for (String part : raw.split("[,;]")) {
+        for (String part : raw.split("[,;]", -1)) {
             String segment = part.trim();
             if (segment.isEmpty()) {
                 throw new BusinessException(400, "namesrvAddr contains an 
empty address segment");
@@ -86,18 +88,6 @@ public final class NamesrvAddrParser {
     }
 
     private static boolean isValidIpv6Literal(String ipv6) {
-        if (ipv6.isEmpty() || ipv6.chars().filter(ch -> ch == ':').count() < 
2) {
-            return false;
-        }
-        for (char ch : ipv6.toCharArray()) {
-            boolean valid = ch == ':'
-                    || Character.isDigit(ch)
-                    || ch >= 'a' && ch <= 'f'
-                    || ch >= 'A' && ch <= 'F';
-            if (!valid) {
-                return false;
-            }
-        }
-        return true;
+        return ADDRESS_VALIDATOR.isValidInet6Address(ipv6);
     }
 }
diff --git 
a/server/src/test/java/org/apache/rocketmq/studio/cluster/nameserver/NamesrvAddrParserTest.java
 
b/server/src/test/java/org/apache/rocketmq/studio/cluster/nameserver/NamesrvAddrParserTest.java
index 2b30bb5fc..24ffd8687 100644
--- 
a/server/src/test/java/org/apache/rocketmq/studio/cluster/nameserver/NamesrvAddrParserTest.java
+++ 
b/server/src/test/java/org/apache/rocketmq/studio/cluster/nameserver/NamesrvAddrParserTest.java
@@ -80,6 +80,16 @@ class NamesrvAddrParserTest {
                 .hasMessageContaining("empty address segment");
     }
 
+    @Test
+    void rejectsTrailingSeparatorsTest() {
+        assertThatThrownBy(() -> NamesrvAddrParser.normalize("ns1:9876,"))
+                .isInstanceOf(BusinessException.class)
+                .hasMessageContaining("empty address segment");
+        assertThatThrownBy(() -> NamesrvAddrParser.normalize("ns1:9876;"))
+                .isInstanceOf(BusinessException.class)
+                .hasMessageContaining("empty address segment");
+    }
+
     @Test
     void rejectsMissingPortTest() {
         assertThatThrownBy(() -> NamesrvAddrParser.normalize("ns1"))
@@ -136,5 +146,11 @@ class NamesrvAddrParserTest {
         assertThatThrownBy(() -> NamesrvAddrParser.normalize("[::1-g]:9876"))
                 .isInstanceOf(BusinessException.class)
                 .hasMessageContaining("malformed IPv6");
+        assertThatThrownBy(() -> NamesrvAddrParser.normalize("[1:2:3]:9876"))
+                .isInstanceOf(BusinessException.class)
+                .hasMessageContaining("malformed IPv6");
+        assertThatThrownBy(() -> NamesrvAddrParser.normalize("[1::2::3]:9876"))
+                .isInstanceOf(BusinessException.class)
+                .hasMessageContaining("malformed IPv6");
     }
 }