This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new 87df5c22 fix: validate every resolved data source address (#1556)
87df5c22 is described below
commit 87df5c2238c2db7d1089b12693e086897f00c6b1
Author: youngkermit8-coder <[email protected]>
AuthorDate: Tue Aug 11 21:02:59 2026 +0800
fix: validate every resolved data source address (#1556)
Signed-off-by: youngkermit8-coder <[email protected]>
---
.../rocketmq/studio/settings/SettingsService.java | 22 +++++++++++++++++-----
.../studio/settings/SettingsServiceTest.java | 21 +++++++++++++++++++++
2 files changed, 38 insertions(+), 5 deletions(-)
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/settings/SettingsService.java
b/server/src/main/java/org/apache/rocketmq/studio/settings/SettingsService.java
index 0845bad9..8fa14758 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/settings/SettingsService.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/settings/SettingsService.java
@@ -311,17 +311,29 @@ public class SettingsService {
return false;
}
try {
- InetAddress address = InetAddress.getByName(normalized);
- return !address.isAnyLocalAddress()
- && !address.isLinkLocalAddress()
- && !address.isLoopbackAddress()
- && !isKnownCloudMetadataAddress(address);
+ return
areAllowedDataSourceAddresses(InetAddress.getAllByName(normalized));
} catch (UnknownHostException exception) {
// Unresolvable host: let the connection attempt surface the real
connectivity error.
return true;
}
}
+ boolean areAllowedDataSourceAddresses(InetAddress[] addresses) {
+ if (addresses == null || addresses.length == 0) {
+ return false;
+ }
+ for (InetAddress address : addresses) {
+ if (address == null
+ || address.isAnyLocalAddress()
+ || address.isLinkLocalAddress()
+ || address.isLoopbackAddress()
+ || isKnownCloudMetadataAddress(address)) {
+ return false;
+ }
+ }
+ return true;
+ }
+
private boolean isKnownCloudMetadataAddress(InetAddress address) {
return CLOUD_METADATA_ADDRESSES.stream()
.anyMatch(metadataAddress ->
Arrays.equals(address.getAddress(), metadataAddress));
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/settings/SettingsServiceTest.java
b/server/src/test/java/org/apache/rocketmq/studio/settings/SettingsServiceTest.java
index 5bee1216..a821fa29 100644
---
a/server/src/test/java/org/apache/rocketmq/studio/settings/SettingsServiceTest.java
+++
b/server/src/test/java/org/apache/rocketmq/studio/settings/SettingsServiceTest.java
@@ -32,6 +32,7 @@ import org.springframework.http.MediaType;
import org.springframework.test.web.client.MockRestServiceServer;
import org.springframework.web.client.RestClient;
+import java.net.InetAddress;
import java.nio.charset.StandardCharsets;
import java.util.Arrays;
import java.util.Base64;
@@ -495,6 +496,26 @@ class SettingsServiceTest {
assertThat(ipv4MappedResult.getMessage()).contains("local or private
address");
}
+ @Test
+ void dataSourceAddressPolicyShouldRejectMixedSafeAndLoopbackResults()
throws Exception {
+ InetAddress[] addresses = {
+ InetAddress.getByName("192.0.2.1"),
+ InetAddress.getByName("127.0.0.1")
+ };
+
+
assertThat(settingsService.areAllowedDataSourceAddresses(addresses)).isFalse();
+ }
+
+ @Test
+ void dataSourceAddressPolicyShouldAcceptAllSafeResults() throws Exception {
+ InetAddress[] addresses = {
+ InetAddress.getByName("192.0.2.1"),
+ InetAddress.getByName("198.51.100.1")
+ };
+
+
assertThat(settingsService.areAllowedDataSourceAddresses(addresses)).isTrue();
+ }
+
@Test
void testConnectionShouldRejectIncompleteBasicAuthentication() {
DataSourceTestResultVO result =
settingsService.testDataSource(DataSourceTestDTO.builder()
