(rocketmq-dashboard) branch rocketmq-studio updated: fix(metrics): disable HTTP redirects in metrics source clients (#1648)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new 50dd1e08 fix(metrics): disable HTTP redirects in metrics source 
clients (#1648)
50dd1e08 is described below

commit 50dd1e08ea26c6adb3adfe7d56ebae0444dd5f60
Author: Yu Xinqiang <yu2651701...@tju.edu.cn>
AuthorDate: Tue Aug 11 20:44:03 2026 +0800

    fix(metrics): disable HTTP redirects in metrics source clients (#1648)
    
    AbstractPrometheusCompatibleMetricsSource follows redirects by default,
    allowing SSRF bypass via redirect to internal addresses. Override
    prepareConnection to set 
HttpURLConnection.setInstanceFollowRedirects(false).
    
    Fixes #1647
---
 .../metrics/AbstractPrometheusCompatibleMetricsSource.java       | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/cluster/metrics/AbstractPrometheusCompatibleMetricsSource.java
 
b/server/src/main/java/org/apache/rocketmq/studio/cluster/metrics/AbstractPrometheusCompatibleMetricsSource.java
index 6909c302..6344b4bc 100644
--- 
a/server/src/main/java/org/apache/rocketmq/studio/cluster/metrics/AbstractPrometheusCompatibleMetricsSource.java
+++ 
b/server/src/main/java/org/apache/rocketmq/studio/cluster/metrics/AbstractPrometheusCompatibleMetricsSource.java
@@ -68,7 +68,14 @@ public abstract class 
AbstractPrometheusCompatibleMetricsSource implements Metri
     protected AbstractPrometheusCompatibleMetricsSource(RestClient.Builder 
restClientBuilder,
                                                          ObjectMapper 
objectMapper,
                                                          MetricsSourceSettings 
settings) {
-        SimpleClientHttpRequestFactory requestFactory = new 
SimpleClientHttpRequestFactory();
+        // Disable redirect following to prevent SSRF bypass via HTTP redirect
+        SimpleClientHttpRequestFactory requestFactory = new 
SimpleClientHttpRequestFactory() {
+            @Override
+            protected void prepareConnection(java.net.HttpURLConnection 
connection, String httpMethod) throws IOException {
+                super.prepareConnection(connection, httpMethod);
+                connection.setInstanceFollowRedirects(false);
+            }
+        };
         requestFactory.setConnectTimeout(settings.getConnectTimeout());
         requestFactory.setReadTimeout(settings.getReadTimeout());
         this.restClient = 
restClientBuilder.requestFactory(requestFactory).build();