You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "youngkermit8-coder (via GitHub)" <gi...@apache.org> on 2026/08/11 17:07:24 UTC
[I] [Studio][Security] Validate every DNS answer in the shared URL guard [rocketmq-dashboard]
youngkermit8-coder opened a new issue, #1943:
URL: https://github.com/apache/rocketmq-dashboard/issues/1943
## Security regression
The shared `UrlHostGuard` introduced for persisted data-source URLs, metrics queries, and LLM API bases resolves a hostname with `InetAddress.getByName`. That checks only one DNS answer. If a hostname has mixed results (for example, a public address plus link-local/cloud-metadata), validation can pass based on the first answer while the HTTP client performs an independent resolution and can connect to another.
This is separate from #1543 / #1556: that fix made `SettingsService.isAllowedDataSourceHost` validate every answer for the connection-test path, but the newer shared guard used by save/query/LLM paths still validates one address.
## Expected behavior
- Resolve all answers with `InetAddress.getAllByName`.
- Reject the hostname if any answer violates the current any-local, link-local, or loopback policy.
- Preserve the existing `allowLoopback` behavior for local LLM gateways.
- Keep unresolvable hosts fail-closed.
## Proposed regression coverage
Extract the address-array policy into a package-private helper and cover all-safe, mixed-safe/link-local, mixed-safe/loopback with both loopback policies, empty, and null address sets.
## Duplicate check
Searched issues and PRs for `UrlHostGuard`, `getAllByName`, `all resolved`, and mixed DNS SSRF. Only #1543/#1556 were found; they change the separate `SettingsService` connection-test guard.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Validate every DNS answer in the shared URL guard [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #1943: [Studio][Security] Validate every DNS answer in the shared URL guard
URL: https://github.com/apache/rocketmq-dashboard/issues/1943
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Validate every DNS answer in the shared URL guard [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #1943:
URL: https://github.com/apache/rocketmq-dashboard/issues/1943#issuecomment-5256320453
**Issue Evaluation**
Category: `bug` | Status: **Confirmed**
The SSRF regression in `UrlHostGuard` has been verified.
**Root Cause:** `UrlHostGuard.java:102` — `isAllowedHost(...)` uses `InetAddress.getByName(...)` which resolves only the first DNS answer. A hostname with mixed results (e.g. public + link-local/cloud-metadata) can bypass validation if the first answer is allowed while subsequent answers would be blocked.
**Impact:** Security — the shared URL guard used by data-source save/query and LLM API bases can be bypassed via DNS rebinding or mixed-record responses.
**Severity:** high
An automated fix proposal can be generated. Reply `/approve` to proceed with PR generation.
---
*Automated evaluation by github-manager-bot*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Validate every DNS answer in the shared URL guard [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #1943:
URL: https://github.com/apache/rocketmq-dashboard/issues/1943#issuecomment-5723043428
This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org