[PR] [ISSUE #1543] Validate every resolved data source address [rocketmq-dashboard]

["youngkermit8-coder (via GitHub)" <gi...@apache.org>]

youngkermit8-coder opened a new pull request, #1556:
URL: https://github.com/apache/rocketmq-dashboard/pull/1556

   ## Summary
   
   - resolve every address returned for a data-source hostname;
   - allow the connection test only when every resolved address passes the existing SSRF policy;
   - reject mixed public/loopback results instead of depending on DNS answer ordering;
   - add focused regression coverage for mixed and all-safe address sets.
   
   ## Root cause
   
   `SettingsService.isAllowedDataSourceHost` used `InetAddress.getByName`, so it
   validated only one address even when a hostname had several DNS answers. The
   HTTP client resolves the hostname independently and may select or retry a
   different answer, allowing a prohibited result to escape the preflight check.
   
   ## Impact
   
   Data-source connection tests now fail closed when any resolved address is
   any-local, link-local, or loopback. Legitimate on-premises private addresses and
   the existing unresolvable-host connectivity error behavior are unchanged.
   
   ## Validation
   
   The base branch currently needs the unrelated compilation fix from #1502. In
   an isolated worktree with #1502 applied:
   
   - two new `SettingsServiceTest` cases passed;
   - Checkstyle reported 0 violations;
   - the Spring Boot package build succeeded.
   
   Compatibility was also validated on a combined isolated tree containing #1502,
   #1512, the latest #1510, and this change:
   
   - `SettingsServiceTest`: 33 tests passed;
   - Checkstyle reported 0 violations;
   - the Spring Boot package build succeeded.
   
   Closes #1543
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [ISSUE #1543] Validate every resolved data source address [rocketmq-dashboard]

["lizhimins (via GitHub)" <gi...@apache.org>]

lizhimins merged PR #1556:
URL: https://github.com/apache/rocketmq-dashboard/pull/1556


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org