(rocketmq-dashboard) branch rocketmq-studio updated: fix(ai): never follow redirects in LLM HTTP clients (#1671)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new 1bbbd149 fix(ai): never follow redirects in LLM HTTP clients (#1671)
1bbbd149 is described below

commit 1bbbd149e60624d09d3f993bd8bb1fd6bdc6c1f8
Author: Yu Xinqiang <yu2651701...@tju.edu.cn>
AuthorDate: Tue Aug 11 20:47:25 2026 +0800

    fix(ai): never follow redirects in LLM HTTP clients (#1671)
    
    HttpClient.newBuilder() follows redirects by default (NORMAL policy).
    The LLM API base URL is user-configurable, so redirect following enables
    SSRF bypass. Add .followRedirects(HttpClient.Redirect.NEVER).
    
    Fixes #1669
---
 .../org/apache/rocketmq/studio/ops/ai/OpenAiCompatibleLlmClient.java     | 1 +
 1 file changed, 1 insertion(+)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/ops/ai/OpenAiCompatibleLlmClient.java
 
b/server/src/main/java/org/apache/rocketmq/studio/ops/ai/OpenAiCompatibleLlmClient.java
index 3417c7ef..2311080b 100644
--- 
a/server/src/main/java/org/apache/rocketmq/studio/ops/ai/OpenAiCompatibleLlmClient.java
+++ 
b/server/src/main/java/org/apache/rocketmq/studio/ops/ai/OpenAiCompatibleLlmClient.java
@@ -62,6 +62,7 @@ public class OpenAiCompatibleLlmClient {
     public OpenAiCompatibleLlmClient(ObjectMapper objectMapper) {
         this(objectMapper, HttpClient.newBuilder()
                 .connectTimeout(Duration.ofSeconds(10))
+                .followRedirects(HttpClient.Redirect.NEVER)
                 .build(), Duration.ofSeconds(60));
     }