youngkermit8-coder opened a new issue, #1543:
URL: https://github.com/apache/rocketmq-dashboard/issues/1543

   ## Security bug
   
   `SettingsService.isAllowedDataSourceHost` validates a hostname with
   `InetAddress.getByName`, which inspects only one address. A hostname may 
resolve
   to multiple addresses. If the selected answer is public while another answer 
is
   loopback, any-local, link-local, or a blocked cloud-metadata endpoint,
   validation can pass even though the HTTP connection performs its own DNS
   resolution and may select or retry the blocked address.
   
   This leaves the data-source connection-test SSRF guard dependent on DNS 
answer
   ordering.
   
   ## Expected behavior
   
   A hostname is allowed only when **every** address returned by
   `InetAddress.getAllByName` passes the existing address policy. A single
   prohibited result must reject the URL. The current behavior for unresolvable
   hostnames and legitimate private/on-premises Prometheus addresses should 
remain
   unchanged.
   
   ## Proposed fix
   
   - resolve all hostname addresses instead of only one;
   - extract the address-array policy into a small testable helper;
   - reject mixed safe/blocked results;
   - add regression tests for all-safe and mixed-address sets.
   
   ## Duplicate check
   
   Searched open and closed issues/PRs for `DNS rebinding`, `getAllByName`,
   `multi-address`, `multiple DNS`, and `all resolved`. No matching contribution
   was found. Existing #1509 covers specific cloud-metadata address constants, 
not
   multi-address DNS validation.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to