github-advanced-security[bot] commented on code in PR #210: URL: https://github.com/apache/solr-mcp/pull/210#discussion_r4381647200
########## src/main/java/org/apache/solr/mcp/server/indexing/UrlTargetPolicy.java: ########## @@ -0,0 +1,127 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.solr.mcp.server.indexing; + +import java.net.InetAddress; +import java.net.URI; +import java.net.UnknownHostException; +import java.util.List; +import java.util.Locale; +import java.util.Set; + +/** + * Pure checks that decide whether {@code index-url} may fetch a URL: absolute http(s) with a host + * and no embedded credentials, a host on the operator's allow-list, and no link-local or + * cloud-metadata address even when the allow-list is {@code *}. The caller resolves the host, so + * this class never performs I/O and the same checks run on every redirect hop. + */ +final class UrlTargetPolicy { + + static final String INVALID_URL = "Provide an absolute http or https URL."; + static final String EMBEDDED_CREDENTIALS = + "Remove the credentials from the URL; this server never sends credentials."; + static final String HOST_NOT_ALLOWED = + "The URL's host is not on this server's allow-list. Allowed by default: " + + "raw.githubusercontent.com, *.githubusercontent.com, github.com. The operator can change " + + "SOLR_INDEX_URL_ALLOWED_HOSTS (use * to allow any host). Nothing was indexed."; + static final String REFUSED_ADDRESS = + "This server does not fetch link-local or cloud-metadata addresses."; + + /** The EC2 IPv6 instance-metadata address; not link-local, so listed explicitly. */ + private static final Set<InetAddress> METADATA_ADDRESSES = + Set.of( + literal("fd00:ec2::254"), // AWS IPv6 Review Comment: ## SonarCloud / IP addresses should not be hardcoded <!--SONAR_ISSUE_KEY:AaF5uESv2c1245phiFey-->Make sure using this hardcoded IP address is safe here. <p>See more on <a href="https://sonarcloud.io/project/issues?id=apache_solr-mcp&issues=AaF5uESv2c1245phiFey&open=AaF5uESv2c1245phiFey&pullRequest=210";>SonarQube Cloud</a></p> [Show more details](https://github.com/apache/solr-mcp/security/code-scanning/2) ########## src/main/java/org/apache/solr/mcp/server/indexing/UrlTargetPolicy.java: ########## @@ -0,0 +1,127 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.solr.mcp.server.indexing; + +import java.net.InetAddress; +import java.net.URI; +import java.net.UnknownHostException; +import java.util.List; +import java.util.Locale; +import java.util.Set; + +/** + * Pure checks that decide whether {@code index-url} may fetch a URL: absolute http(s) with a host + * and no embedded credentials, a host on the operator's allow-list, and no link-local or + * cloud-metadata address even when the allow-list is {@code *}. The caller resolves the host, so + * this class never performs I/O and the same checks run on every redirect hop. + */ +final class UrlTargetPolicy { + + static final String INVALID_URL = "Provide an absolute http or https URL."; + static final String EMBEDDED_CREDENTIALS = + "Remove the credentials from the URL; this server never sends credentials."; + static final String HOST_NOT_ALLOWED = + "The URL's host is not on this server's allow-list. Allowed by default: " + + "raw.githubusercontent.com, *.githubusercontent.com, github.com. The operator can change " + + "SOLR_INDEX_URL_ALLOWED_HOSTS (use * to allow any host). Nothing was indexed."; + static final String REFUSED_ADDRESS = + "This server does not fetch link-local or cloud-metadata addresses."; + + /** The EC2 IPv6 instance-metadata address; not link-local, so listed explicitly. */ + private static final Set<InetAddress> METADATA_ADDRESSES = + Set.of( + literal("fd00:ec2::254"), // AWS IPv6 + literal("100.100.100.200"), // Alibaba Cloud + literal("168.63.129.16")); // Azure WireServer Review Comment: ## SonarCloud / IP addresses should not be hardcoded <!--SONAR_ISSUE_KEY:AaF5uESv2c1245phiFe0-->Make sure using this hardcoded IP address is safe here. <p>See more on <a href="https://sonarcloud.io/project/issues?id=apache_solr-mcp&issues=AaF5uESv2c1245phiFe0&open=AaF5uESv2c1245phiFe0&pullRequest=210";>SonarQube Cloud</a></p> [Show more details](https://github.com/apache/solr-mcp/security/code-scanning/3) ########## src/main/java/org/apache/solr/mcp/server/indexing/UrlTargetPolicy.java: ########## @@ -0,0 +1,127 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.solr.mcp.server.indexing; + +import java.net.InetAddress; +import java.net.URI; +import java.net.UnknownHostException; +import java.util.List; +import java.util.Locale; +import java.util.Set; + +/** + * Pure checks that decide whether {@code index-url} may fetch a URL: absolute http(s) with a host + * and no embedded credentials, a host on the operator's allow-list, and no link-local or + * cloud-metadata address even when the allow-list is {@code *}. The caller resolves the host, so + * this class never performs I/O and the same checks run on every redirect hop. + */ +final class UrlTargetPolicy { + + static final String INVALID_URL = "Provide an absolute http or https URL."; + static final String EMBEDDED_CREDENTIALS = + "Remove the credentials from the URL; this server never sends credentials."; + static final String HOST_NOT_ALLOWED = + "The URL's host is not on this server's allow-list. Allowed by default: " + + "raw.githubusercontent.com, *.githubusercontent.com, github.com. The operator can change " + + "SOLR_INDEX_URL_ALLOWED_HOSTS (use * to allow any host). Nothing was indexed."; + static final String REFUSED_ADDRESS = + "This server does not fetch link-local or cloud-metadata addresses."; + + /** The EC2 IPv6 instance-metadata address; not link-local, so listed explicitly. */ + private static final Set<InetAddress> METADATA_ADDRESSES = + Set.of( + literal("fd00:ec2::254"), // AWS IPv6 + literal("100.100.100.200"), // Alibaba Cloud Review Comment: ## SonarCloud / IP addresses should not be hardcoded <!--SONAR_ISSUE_KEY:AaF5uESv2c1245phiFez-->Make sure using this hardcoded IP address is safe here. <p>See more on <a href="https://sonarcloud.io/project/issues?id=apache_solr-mcp&issues=AaF5uESv2c1245phiFez&open=AaF5uESv2c1245phiFez&pullRequest=210";>SonarQube Cloud</a></p> [Show more details](https://github.com/apache/solr-mcp/security/code-scanning/1) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
