youngkermit8-coder opened a new issue, #1543: URL: https://github.com/apache/rocketmq-dashboard/issues/1543
## Security bug `SettingsService.isAllowedDataSourceHost` validates a hostname with `InetAddress.getByName`, which inspects only one address. A hostname may resolve to multiple addresses. If the selected answer is public while another answer is loopback, any-local, link-local, or a blocked cloud-metadata endpoint, validation can pass even though the HTTP connection performs its own DNS resolution and may select or retry the blocked address. This leaves the data-source connection-test SSRF guard dependent on DNS answer ordering. ## Expected behavior A hostname is allowed only when **every** address returned by `InetAddress.getAllByName` passes the existing address policy. A single prohibited result must reject the URL. The current behavior for unresolvable hostnames and legitimate private/on-premises Prometheus addresses should remain unchanged. ## Proposed fix - resolve all hostname addresses instead of only one; - extract the address-array policy into a small testable helper; - reject mixed safe/blocked results; - add regression tests for all-safe and mixed-address sets. ## Duplicate check Searched open and closed issues/PRs for `DNS rebinding`, `getAllByName`, `multi-address`, `multiple DNS`, and `all resolved`. No matching contribution was found. Existing #1509 covers specific cloud-metadata address constants, not multi-address DNS validation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
