Copilot commented on code in PR #6388: URL: https://github.com/apache/shenyu/pull/6388#discussion_r3419539843
########## shenyu-admin/src/http/http-debug-app-auth-controller-api.http: ########## @@ -61,16 +61,11 @@ X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6ImFkbWluIiw } ### updateSk -GET http://localhost:9095/appAuth/updateSk?appKey=123&appSecret=123 +POST http://localhost:9095/appAuth/updateSk?appKey=123&appSecret=123 Accept: application/json Content-Type: application/json X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6ImFkbWluIiwiZXhwIjoxNjQ4NjUwMDg2fQ.aDeChT_Ey6FwYDdzSkc9ZLBHd5v-LVUZ6BPcYqJCo-Y Review Comment: The debug request still sends `appSecret` in the URL query string even after switching to POST, which can still leak via access logs and proxies. Update the example to send `appKey`/`appSecret` in the request body (or as form-encoded parameters) and align/remove `Content-Type: application/json` if there is no JSON body. ########## shenyu-dist/shenyu-bootstrap-dist/src/main/release-docs/LICENSE: ########## @@ -631,6 +631,31 @@ The text of each license is the standard Apache 2.0 license. javatuples 1.2: https://mvnrepository.com/artifact/org.javatuples/javatuples, Apache 2.0 jna-platform 5.16.0: https://github.com/java-native-access/jna, Apache 2.0 + lz4-java 1.10.1: https://github.com/yawkat/lz4-java, Apache 2.0 + itu 1.14.0: https://github.com/ethlo/itu, Apache 2.0 + jsonschema-generator 4.38.0: https://github.com/victools/jsonschema-generator, The Apache License, Version 2.0 + jsonschema-module-jackson 4.38.0: https://github.com/victools/jsonschema-generator, The Apache License, Version 2.0 + jsonschema-module-swagger-2 4.38.0: https://github.com/victools/jsonschema-generator, The Apache License, Version 2.0 + re2j 1.8: https://github.com/google/re2j, Go License Review Comment: The listed license for `re2j` appears incorrect. `google/re2j` is not under the 'Go License'; please update this entry to match the project's actual license (e.g., BSD-3-Clause), to keep third-party attributions accurate. ########## shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/SandboxController.java: ########## @@ -49,6 +50,7 @@ public SandboxController(final SandboxService sandboxService) { * @throws IOException throw io exception */ @PostMapping(path = "/proxyGateway") + @RequiresPermissions("system:authen:list") Review Comment: Using a `list` permission to guard a request-forwarding + server-side signing endpoint is overly permissive and semantically mismatched (this endpoint is an action, not a read/list operation). Consider introducing and enforcing a dedicated permission (e.g., `system:sandbox:proxy` / `system:sandbox:execute`) so access can be granted with least privilege. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
