Aias00 opened a new issue, #6403:
URL: https://github.com/apache/shenyu/issues/6403
### Description
DividePlugin reads the specify-domain request header from any incoming HTTP
request and calls upstream.setUrl() directly on the object returned by
RandomLoadBalancer. Because the load balancer returns a direct reference to the
cached Upstream object (not a copy), this setUrl() call permanently mutates the
cached entry. All subsequent requests to the same route are forwarded to the
attacker-supplied URL until an admin pushes a config update or restarts the
gateway.
Additionally, the header value is not validated against the configured
upstream list, allowing arbitrary host redirection.
Affected Files:
shenyu-plugin/shenyu-plugin-proxy/shenyu-plugin-divide/src/main/java/org/apache/shenyu/plugin/divide/DividePlugin.java
shenyu-loadbalancer/src/main/java/org/apache/shenyu/loadbalancer/spi/RandomLoadBalancer.java
Proposed Change:
Validate the specify-domain header value against the configured upstream
list; reject values not present in the list.
Create a per-request copy of the Upstream object before calling setUrl() to
prevent mutation of the shared cached instance:
javaString requested = specifyDomains.get(0);
if (upstreamList.stream().anyMatch(u -> u.getUrl().equals(requested))) {
upstream = Upstream.builder()
.url(requested)
.protocol(upstream.getProtocol())
.weight(upstream.getWeight())
.warmup(upstream.getWarmup())
.status(upstream.isStatus())
.build();
}
Acceptance Criteria:
A request with an arbitrary specify-domain value not in the configured
upstream list is rejected or ignored.
A valid specify-domain value only affects the current request; subsequent
requests continue routing to the originally configured upstreams.
Existing specify-domain functionality for legitimate use cases is preserved.
### Task List
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
