The GitHub Actions job "CI" on rocketmq-dashboard.git/rocketmq-studio has succeeded. Run started by GitHub user lizhimins (triggered by lizhimins).
Head commit for run: 200566e6a4d8a4874f8e8bdc10a1d1d3b26cff50 / zhaohai <[email protected]> fix(security): harden SSRF guards, auth fail-closed and actuator exposure (#1673) - Add shared UrlHostGuard (common.util) and apply it on every path that makes a server-side request to a caller-supplied URL: * SettingsService.createDataSource/updateDataSource now reject loopback, link-local and metadata addresses when saving (previously only the test path was guarded, so a data source pointing at 127.0.0.1 could be stored and queried later); * AbstractPrometheusCompatibleMetricsSource validates the stored base URL on every query (defense in depth against direct DB edits); * LlmConfigService.validate() (used by both save and test) now rejects link-local/metadata hosts while allowing loopback, so a local ollama gateway keeps working. The guard fails closed: unresolvable hosts are rejected instead of being handed to the connection layer, removing the UnknownHostException bypass. - Auth: default studio.auth.login-required=true (application.yml, compose, deploy.sh) and AuthInterceptor now fails closed when the settings store cannot be read. - Deploy: MySQL root password externalized to MYSQL_ROOT_PASSWORD env with a compose-default fallback; healthcheck reads the password from the env; /actuator/ is no longer proxied wholesale at the edge (only /actuator/health is exposed) in both web/nginx.conf and deploy/nginx.conf; deploy.sh no longer publishes the backend 8888 port to the host. Tests: SettingsServiceTest (incl. two new SSRF rejection tests), LlmConfigServiceTest, AuthInterceptorTest all green. Report URL: https://github.com/apache/rocketmq-dashboard/actions/runs/31496074644 With regards, GitHub Actions via GitBox
