kali834x opened a new pull request, #1317: URL: https://github.com/apache/axis-axis2-java-core/pull/1317
invokeTheService in HappyAxis.jsp now builds the address it posts the Version probe to from the connector the request arrived on (getScheme, getLocalAddr, getLocalPort, getContextPath) instead of request.getRequestURL(), and the IP instance field that carried it between requests is gone. getRequestURL is assembled from the client's Host header (or a forwarded host), and the page is anonymous and linked from the welcome page, so GET /axis2/axis2-web/HappyAxis.jsp with Host: 10.0.0.5:8080 made the server open a connection to that host and post a soap request to /axis2/services/Version, rendering the reply into the page when it parsed as soap and otherwise answering through the success/failure branch whether the port was open (server-side request forgery, CWE-918). the probe was always meant as an internal self-check, which the existing comment about not using frontendHostUrl says, so the socket's own address keeps that intent; the trade-off is that a deployment whose trusted proxy r ewrites the scheme now probes the local connector with the rewritten scheme instead of going back out through the proxy. a webapp integration test sends the page a Host header naming a local listener: before the change the listener receives POST /axis2/services/Version, after it receives nothing and the page still reports the Version service. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
