youngkermit8-coder opened a new issue, #1509: URL: https://github.com/apache/rocketmq-dashboard/issues/1509
## Bug Report ### Runtime environment - RocketMQ Dashboard branch: `rocketmq-studio` - JDK: 21 ### Description `SettingsService.isAllowedDataSourceHost()` protects the server-side data-source connection test from cloud metadata endpoints by rejecting link-local addresses. This blocks the usual IPv4 IMDS endpoint (`169.254.169.254`), but the AWS IMDS IPv6 endpoint (`fd00:ec2::254`) passes the current checks. On JDK 21, `InetAddress` reports all of the following as `false` for `fd00:ec2::254`: - `isAnyLocalAddress()` - `isLinkLocalAddress()` - `isLoopbackAddress()` - `isSiteLocalAddress()` As a result, a data-source test URL such as `http://[fd00:ec2::254]/latest/meta-data/` proceeds to the server-side HTTP client instead of being rejected as a metadata address. AWS documents `[fd00:ec2::254]` as the IPv6 endpoint for the EC2 Instance Metadata Service: - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-limiting-access.html ### Expected behavior Both documented AWS IMDS endpoints must be rejected by the data-source URL guard, while ordinary internal Prometheus addresses remain allowed for on-premise deployments. ### Proposed scope - Detect the exact IPv6 IMDS address using its resolved 16-byte representation so alternate IPv6 text forms cannot bypass the check. - Add a regression test for `http://[fd00:ec2::254]/latest/meta-data/`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
