You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by li...@apache.org on 2026/08/11 12:46:55 UTC
(rocketmq-dashboard) branch rocketmq-studio updated: fix(proxy): disable redirects in hot-reload requests (#1667)
This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new 0035a321 fix(proxy): disable redirects in hot-reload requests (#1667)
0035a321 is described below
commit 0035a321d27b33d141b02b8c7bac01db1f24ad30
Author: Yu Xinqiang <yu...@tju.edu.cn>
AuthorDate: Tue Aug 11 20:46:49 2026 +0800
fix(proxy): disable redirects in hot-reload requests (#1667)
ProxyAddressService RestTemplate follows redirects by default, allowing
SSRF bypass via redirect to internal addresses. Override prepareConnection
to set HttpURLConnection.setInstanceFollowRedirects(false).
Fixes #1657
---
.../rocketmq/studio/cluster/proxy/ProxyAddressService.java | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyAddressService.java b/server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyAddressService.java
index 08ccab66..4804d267 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyAddressService.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyAddressService.java
@@ -27,6 +27,7 @@ import org.springframework.web.client.HttpStatusCodeException;
import org.springframework.web.client.ResourceAccessException;
import org.springframework.web.client.RestTemplate;
+import java.io.IOException;
import java.time.Duration;
import java.util.ArrayList;
@@ -52,7 +53,13 @@ public class ProxyAddressService {
private final RestTemplate restTemplate;
public ProxyAddressService() {
- SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
+ SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory() {
+ @Override
+ protected void prepareConnection(java.net.HttpURLConnection connection, String httpMethod) throws IOException {
+ super.prepareConnection(connection, httpMethod);
+ connection.setInstanceFollowRedirects(false);
+ }
+ };
factory.setConnectTimeout(Duration.ofSeconds(3));
factory.setReadTimeout(Duration.ofSeconds(3));
this.restTemplate = new RestTemplate(factory);