You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rocketmq.apache.org by "tju-yxq (via GitHub)" <gi...@apache.org> on 2026/08/11 05:51:09 UTC
[PR] [ISSUE #1609] Disable HTTP redirect following to prevent SSRF bypass [rocketmq-dashboard]
tju-yxq opened a new pull request, #1611:
URL: https://github.com/apache/rocketmq-dashboard/pull/1611
Fixes #1609. The SimpleClientHttpRequestFactory follows redirects by default, allowing SSRF bypass. Added setFollowRedirects(false).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [ISSUE #1609] Disable HTTP redirect following to prevent SSRF bypass [rocketmq-dashboard]
Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins commented on PR #1611:
URL: https://github.com/apache/rocketmq-dashboard/pull/1611#issuecomment-5253453787
Closing as duplicate: the same redirect-following disable for data source connection tests was already merged via #1516 (DataSourceClientHttpRequestFactory); this PR targets the pre-#1512 constructor shape and no longer applies.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [ISSUE #1609] Disable HTTP redirect following to prevent SSRF bypass [rocketmq-dashboard]
Posted by "tju-yxq (via GitHub)" <gi...@apache.org>.
tju-yxq commented on PR #1611:
URL: https://github.com/apache/rocketmq-dashboard/pull/1611#issuecomment-5269875377
Follow-up audit note:
I updated this closed PR body to clarify that it was an earlier attempt and not the final merged fix in current `rocketmq-studio`. The current settings data source redirect hardening is covered by `DataSourceClientHttpRequestFactoryTest#prepareConnectionShouldDisableRedirectsTest`.
The evidence is code inspection plus focused unit testing; no live redirect-to-internal-service SSRF reproduction was performed for this PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [ISSUE #1609] Disable HTTP redirect following to prevent SSRF bypass [rocketmq-dashboard]
Posted by "lizhimins (via GitHub)" <gi...@apache.org>.
lizhimins closed pull request #1611: [ISSUE #1609] Disable HTTP redirect following to prevent SSRF bypass
URL: https://github.com/apache/rocketmq-dashboard/pull/1611
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org