Copilot commented on code in PR #13821:
URL: https://github.com/apache/cloudstack/pull/13821#discussion_r3803008529
##########
server/src/main/java/org/apache/cloudstack/dns/DnsProviderManagerImpl.java:
##########
@@ -162,14 +164,43 @@ private DnsProvider getProviderByType(DnsProviderType
type) {
throw new CloudRuntimeException("No plugin found for DNS provider
type: " + type);
}
+ /**
+ * Trims and rejects a DNS provider URL that resolves to an illegal
address before any provider client
+ * is given the chance to connect to it. See {@link
UriUtils#validateUrl(String)} for the exact rules
+ * enforced (including the requirement that the URL declares an {@code
http}/{@code https} scheme).
+ * Private/site-local addresses (e.g. {@code 192.168.0.0/16}) are only
permitted for root admin callers.
+ *
+ * @return the trimmed URL.
+ * @throws InvalidParameterValueException if the URL is blank, fails
validation, or is a private address
+ * requested by a non-root-admin caller.
+ */
+ private String validateDnsServerUrl(String url, Account caller) {
+ String trimmedUrl = StringUtils.trim(url);
+ if (StringUtils.isBlank(trimmedUrl)) {
+ throw new InvalidParameterValueException("URL cannot be blank.");
+ }
+ Pair<String, Integer> hostAndPort;
+ try {
+ hostAndPort = UriUtils.validateUrl(trimmedUrl);
+ } catch (IllegalArgumentException e) {
+ throw new InvalidParameterValueException(e.getMessage());
+ }
+ if (!accountMgr.isRootAdmin(caller.getId()) &&
NetUtils.isSiteLocalAddress(hostAndPort.first())) {
+ throw new InvalidParameterValueException(
+ "Only root admin accounts can configure a DNS server on a
private/internal network address.");
+ }
Review Comment:
The validation currently only blocks site-local/private address literals for
non-root admins; it does not block loopback (e.g., 127.0.0.1 / ::1),
link-local, multicast, unspecified/any-local, nor does it handle hostnames that
resolve to private/loopback ranges. This leaves an SSRF/egress gap if a user
supplies a hostname that resolves internally, and it also won’t satisfy the new
loopback-rejection tests. Recommendation (mandatory): resolve the host to one
or more InetAddress values and reject any
loopback/link-local/multicast/any-local addresses for all callers, and reject
private/site-local/ULA ranges for non-root admins (apply the check to every
resolved address).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
