github-advanced-security[bot] commented on code in PR #7868:
URL: https://github.com/apache/shenyu/pull/7868#discussion_r4320687182
##########
shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/HttpUtils.java:
##########
@@ -356,6 +359,26 @@
.execute();
}
+ /**
+ * Fetch an external document using DNS returned by {@link
UrlSecurityUtils#validatedDns}.
+ * The URL must be the same URL that was validated. Isolate connections
from the ordinary
+ * client, bypass proxies and reject redirects so only validated
destinations are used.
+ * @param url validated URL
+ * @param validatedDns pinned DNS for the validated URL
+ * @return response which the caller must close
+ * @throws IOException if the request fails
+ */
+ public Response requestForValidatedResponse(final String url, final Dns
validatedDns) throws IOException {
+ OkHttpClient client = httpClient.newBuilder()
+ .dns(validatedDns)
+ .proxy(Proxy.NO_PROXY)
+ .connectionPool(new ConnectionPool(0, 1, TimeUnit.SECONDS))
+ .followRedirects(false)
+ .followSslRedirects(false)
+ .build();
+ return client.newCall(new
Request.Builder().url(url).get().build()).execute();
Review Comment:
## CodeQL / Server-side request forgery
Potential server-side request forgery due to a [user-provided value](1).
[Show more
details](https://github.com/apache/shenyu/security/code-scanning/87)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
