You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "youngkermit8-coder (via GitHub)" <gi...@apache.org> on 2026/08/10 21:43:55 UTC
[I] [Studio][Security] Prevent data source tests from following unvalidated redirects [rocketmq-dashboard]
youngkermit8-coder opened a new issue, #1515:
URL: https://github.com/apache/rocketmq-dashboard/issues/1515
## Bug Report
### Environment
- Branch: `rocketmq-studio`
- JDK: 21
### Description
`SettingsService` validates only the user-supplied data-source host before issuing its server-side Prometheus request. The service uses `SimpleClientHttpRequestFactory`, which delegates GET requests to `HttpURLConnection`; automatic redirect following is enabled by default on JDK 21.
An allowed public URL can therefore respond with a redirect to a host that the SSRF guard would reject if supplied directly, such as loopback or a cloud metadata endpoint. The redirected destination is followed by the HTTP layer without passing through `isAllowedDataSourceHost()`.
JDK 21 reproduction:
```text
HttpURLConnection.getFollowRedirects() == true
connection.getInstanceFollowRedirects() == true
```
### Expected behavior
The data-source connection test must not automatically follow redirects to an unvalidated destination. A redirect response should make the connection test fail without issuing the redirected request.
### Proposed scope
- Use a dedicated `SimpleClientHttpRequestFactory` subclass that disables instance-level redirect following after Spring prepares the connection.
- Keep the existing connect/read timeouts and initial host validation unchanged.
- Add a deterministic unit test proving the prepared connection has redirects disabled without making a network request.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Prevent data source tests from following unvalidated redirects [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #1515:
URL: https://github.com/apache/rocketmq-dashboard/issues/1515#issuecomment-5246622690
**Issue Evaluation**
Category: `bug` | Status: **Confirmed**
The SSRF bypass via redirect following in data source tests is a valid security concern. Following redirects to loopback/link-local addresses after initial validation defeats the purpose of SSRF protection.
**Root Cause:** Missing redirect validation in test connection flow
**Impact:** Security bypass allowing access to internal services
**Severity:** high
An automated fix proposal can be generated. Reply `/approve` to proceed with PR generation.
---
*Automated evaluation by github-manager-bot*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Prevent data source tests from following unvalidated redirects [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #1515: [Studio][Security] Prevent data source tests from following unvalidated redirects
URL: https://github.com/apache/rocketmq-dashboard/issues/1515
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Security] Prevent data source tests from following unvalidated redirects [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #1515:
URL: https://github.com/apache/rocketmq-dashboard/issues/1515#issuecomment-5321755009
This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org