VGalaxies commented on code in PR #2945:
URL: https://github.com/apache/hugegraph/pull/2945#discussion_r3564825006
##########
hugegraph-store/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java:
##########
@@ -168,27 +171,40 @@ public Map<String, Object>
dumpPartition(@PathVariable(value = "id") int id) thr
}
cfIterator.close();
});
- return okMap("ok", null);
+ return ok("ok", "");
}
/**
* Print all keys in the partition
*/
@GetMapping(value = "/partition/clean/{id}", produces =
MediaType.APPLICATION_JSON_VALUE)
- public Map<String, Object> cleanPartition(@PathVariable(value = "id") int
id) throws
-
PDException {
+ public ResponseEntity<Map<String, Object>> cleanPartition(
+ @PathVariable(value = "id") int id) throws PDException {
HgStoreEngine storeEngine = nodeService.getStoreEngine();
BusinessHandler handler = storeEngine.getBusinessHandler();
storeEngine.getPartitionEngine(id).getPartitions().forEach((graph,
partition) -> {
handler.cleanPartition(graph, id);
});
- return okMap("ok", null);
+ return ok("ok", "");
}
@GetMapping(value = "/arthasstart", produces = "application/json")
- public Map<String, Object> arthasstart(
- @RequestParam(required = false, defaultValue = "") String flags) {
+ public ResponseEntity<Map<String, Object>> arthasstart(
+ @RequestParam(required = false, defaultValue = "") String flags,
+ HttpServletRequest request) {
+ // Ignore proxy headers to prevent IP spoofing.
+ // NOTE: If behind a reverse proxy (e.g., Nginx), getRemoteAddr()
returns the proxy's IP.
+ // Ensure the proxy is configured to block untrusted external access.
+ String remoteAddr = getCleanIp(request.getRemoteAddr());
+ boolean isLocalRequest =
Review Comment:
**High: Local proxies bypass the localhost restriction**
`hugegraph-store/hg-store-node/src/main/java/org/apache/hugegraph/store/node/controller/PartitionAPI.java:200`
**Evidence**
- `getRemoteAddr()` identifies the immediate peer, so an external request
forwarded by a same-host reverse proxy appears as `127.0.0.1` and reaches
`ArthasAgent.attach()` at line 213. No authentication interceptor or security
configuration exists in `hg-store-node`.
**Impact**
- Remote callers can still trigger dynamic agent attachment in a common
reverse-proxy deployment despite the endpoint claiming localhost-only access.
**Requested fix**
- Do not use peer IP as the sole authorization boundary; require
authenticated administrative access or expose this endpoint through a separate
listener explicitly bound to loopback.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
