Aias00 opened a new issue, #7595: URL: https://github.com/apache/shenyu/issues/7595
## Symptom `UrlSecurityUtils.isSensitivePort` (`shenyu-admin/.../utils/UrlSecurityUtils.java:184-219`) treats `8080, 8081, 9090, 9091` as "sensitive" (line 209). These are the **most common Spring Boot application / management ports** — exactly where a user's own services run. As a result, legitimate swagger imports are rejected with `Access to sensitive ports is not allowed`. ## Evidence - `isSensitivePort` set (lines 191-216) includes `8080, 8081, 9090, 9091`. - This guard is invoked by the swagger import path: `SwaggerImportServiceImpl` → `UrlSecurityUtils.validateUrlForSSRF` (and `validateHostForSSRF` → `isSensitivePort`). So importing a swagger doc from `http://my-service:8080/v3/api-docs` fails. - Likewise `POST /swagger/import/mcp` (the MCP tool zero-code generation entry) is blocked for the same common ports. ## Impact The swagger import / MCP-generation feature — a primary way to onboard APIs — fails for the default deployment topology (Spring Boot on 8080/9090). Users must relocate services to non-standard ports to work around it. ## Additional concern (TOCTOU / DNS rebinding) `validateHostForSSRF` resolves the host via `InetAddress.getAllByName` (line 102) for the check, but the actual HTTP fetch (okhttp) re-resolves DNS → a DNS-rebinding / TOCTOU window remains. The port check and host check should be evaluated against the *actually connected* address (pin the resolved IP used for the security check, or use a custom `SocketFactory` / `Address` that reuses the validated resolution). ## Proposal - Distinguish "common application ports" from genuinely sensitive/internal ports. The real SSRF risk is metadata/internal IPs (e.g. cloud metadata `169.254.169.254:80`, link-local, private ranges) and well-known infra ports (22, 25, 53, 3306, 5432, 6379, 2181, 9200, etc.). `8080/8081/9090/9091` are application ports, not inherently sensitive. - Make the sensitive-port policy configurable (allow/deny list) rather than hardcoded. - Close the DNS-rebinding TOCTOU by pinning the validated resolution to the actual connection. ## Related - #7592 (same admin / swagger-import area). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
