(rocketmq-dashboard) branch rocketmq-studio updated: fix(proxy): disable redirects in hot-reload requests (#1667)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new 0035a321 fix(proxy): disable redirects in hot-reload requests (#1667)
0035a321 is described below

commit 0035a321d27b33d141b02b8c7bac01db1f24ad30
Author: Yu Xinqiang <yu2651701...@tju.edu.cn>
AuthorDate: Tue Aug 11 20:46:49 2026 +0800

    fix(proxy): disable redirects in hot-reload requests (#1667)
    
    ProxyAddressService RestTemplate follows redirects by default, allowing
    SSRF bypass via redirect to internal addresses. Override prepareConnection
    to set HttpURLConnection.setInstanceFollowRedirects(false).
    
    Fixes #1657
---
 .../rocketmq/studio/cluster/proxy/ProxyAddressService.java       | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyAddressService.java
 
b/server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyAddressService.java
index 08ccab66..4804d267 100644
--- 
a/server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyAddressService.java
+++ 
b/server/src/main/java/org/apache/rocketmq/studio/cluster/proxy/ProxyAddressService.java
@@ -27,6 +27,7 @@ import org.springframework.web.client.HttpStatusCodeException;
 import org.springframework.web.client.ResourceAccessException;
 import org.springframework.web.client.RestTemplate;
 
+import java.io.IOException;
 import java.time.Duration;
 
 import java.util.ArrayList;
@@ -52,7 +53,13 @@ public class ProxyAddressService {
     private final RestTemplate restTemplate;
 
     public ProxyAddressService() {
-        SimpleClientHttpRequestFactory factory = new 
SimpleClientHttpRequestFactory();
+        SimpleClientHttpRequestFactory factory = new 
SimpleClientHttpRequestFactory() {
+            @Override
+            protected void prepareConnection(java.net.HttpURLConnection 
connection, String httpMethod) throws IOException {
+                super.prepareConnection(connection, httpMethod);
+                connection.setInstanceFollowRedirects(false);
+            }
+        };
         factory.setConnectTimeout(Duration.ofSeconds(3));
         factory.setReadTimeout(Duration.ofSeconds(3));
         this.restTemplate = new RestTemplate(factory);