The GitHub Actions job "CI" on rocketmq-dashboard.git/rocketmq-studio has 
succeeded.
Run started by GitHub user lizhimins (triggered by lizhimins).

Head commit for run:
200566e6a4d8a4874f8e8bdc10a1d1d3b26cff50 / zhaohai 
<[email protected]>
fix(security): harden SSRF guards, auth fail-closed and actuator exposure 
(#1673)

- Add shared UrlHostGuard (common.util) and apply it on every path that
  makes a server-side request to a caller-supplied URL:
  * SettingsService.createDataSource/updateDataSource now reject loopback,
    link-local and metadata addresses when saving (previously only the test
    path was guarded, so a data source pointing at 127.0.0.1 could be stored
    and queried later);
  * AbstractPrometheusCompatibleMetricsSource validates the stored base URL
    on every query (defense in depth against direct DB edits);
  * LlmConfigService.validate() (used by both save and test) now rejects
    link-local/metadata hosts while allowing loopback, so a local ollama
    gateway keeps working.
  The guard fails closed: unresolvable hosts are rejected instead of being
  handed to the connection layer, removing the UnknownHostException bypass.
- Auth: default studio.auth.login-required=true (application.yml, compose,
  deploy.sh) and AuthInterceptor now fails closed when the settings store
  cannot be read.
- Deploy: MySQL root password externalized to MYSQL_ROOT_PASSWORD env with a
  compose-default fallback; healthcheck reads the password from the env;
  /actuator/ is no longer proxied wholesale at the edge (only /actuator/health
  is exposed) in both web/nginx.conf and deploy/nginx.conf; deploy.sh no
  longer publishes the backend 8888 port to the host.

Tests: SettingsServiceTest (incl. two new SSRF rejection tests), 
LlmConfigServiceTest,
AuthInterceptorTest all green.

Report URL: 
https://github.com/apache/rocketmq-dashboard/actions/runs/31496074644

With regards,
GitHub Actions via GitBox

Reply via email to