You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "youngkermit8-coder (via GitHub)" <gi...@apache.org> on 2026/08/10 21:27:41 UTC
[I] [Studio][Test] Restore SettingsService tests after loopback SSRF hardening [rocketmq-dashboard]
youngkermit8-coder opened a new issue, #1511:
URL: https://github.com/apache/rocketmq-dashboard/issues/1511
## Bug Report
### Environment
- Branch: `rocketmq-studio`
- JDK: 21
### Description
`SettingsServiceTest` starts its Prometheus fixture on `127.0.0.1`, while the production SSRF guard now correctly rejects loopback data-source URLs after #1423. Seven existing tests therefore fail before they reach their intended HTTP/authentication assertions.
### Reproduction
```text
mvn -B -ntp -Dtest=SettingsServiceTest test
Tests run: 30, Failures: 7, Errors: 0, Skipped: 0
```
The failures include the query URL, Basic authentication, Bearer authentication, locale normalization, validation ordering, and Prometheus error-detail cases. Each receives `Data source URL must not point to a local or private address` because the shared fixture URL is loopback.
### Expected behavior
The test suite should exercise outbound request construction deterministically without weakening the production SSRF policy or depending on a host network interface.
### Proposed scope
- Let tests inject a prebuilt `RestClient` while keeping the public production constructor and its connect/read timeout configuration unchanged.
- Replace the loopback `HttpServer` fixture with Spring's `MockRestServiceServer`.
- Preserve assertions for request path/query, authentication headers, successful responses, and Prometheus error bodies.
- Verify all `SettingsServiceTest` cases pass without real network access.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Test] Restore SettingsService tests after loopback SSRF hardening [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #1511:
URL: https://github.com/apache/rocketmq-dashboard/issues/1511#issuecomment-5321755700
This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Test] Restore SettingsService tests after loopback SSRF hardening [rocketmq-dashboard]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed issue #1511: [Studio][Test] Restore SettingsService tests after loopback SSRF hardening
URL: https://github.com/apache/rocketmq-dashboard/issues/1511
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Studio][Test] Restore SettingsService tests after loopback SSRF hardening [rocketmq-dashboard]
Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.
RockteMQ-AI commented on issue #1511:
URL: https://github.com/apache/rocketmq-dashboard/issues/1511#issuecomment-5246623088
**Issue Evaluation**
Category: `bug` | Status: **Confirmed**
The broken `SettingsService` tests after SSRF hardening is a valid test maintenance issue. Tests that depend on external URLs need to be updated to work with the new loopback-only validation.
**Root Cause:** Test fixtures not updated after security hardening
**Impact:** Test suite failures blocking CI
**Severity:** medium
An automated fix proposal can be generated. Reply `/approve` to proceed with PR generation.
---
*Automated evaluation by github-manager-bot*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org