wwbmmm commented on code in PR #3525:
URL: https://github.com/apache/brpc/pull/3525#discussion_r3944025066
##########
src/brpc/policy/http_rpc_protocol.cpp:
##########
@@ -1605,7 +1605,8 @@ void ProcessHttpRequest(InputMessageBase *msg) {
mp->service->CallMethod(mp->method, cntl, &breq, &bres, nullptr);
return;
}
- if (RejectBuiltinAccess(cntl, *server, mp)) {
+ if (server->RejectBuiltinAccess(cntl, mp) ||
Review Comment:
The new gate is placed after the `server->options().http_master_service`
early-dispatch block (around line 1543), which calls into the user-provided
http_master_service and returns before reaching this check. http_master_service
is a non-builtin user service, so on a server that sets both `internal_port`
and `http_master_service`, an ordinary (non-builtin) service is still reachable
on internal_port, contradicting both the new docs and the guarantee that only
builtin/tabbed services are served there. The same pattern also exists for
`baidu_master_service` in baidu_rpc_protocol.cpp, whose dispatch happens before
the new gate. Please move the internal-port restriction ahead of these
master-service dispatch blocks (or apply it centrally) so the gate covers every
non-builtin path.
---
🤖 This reply was automatically generated by brpc-oncall
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
