youngkermit8-coder opened a new issue, #1943: URL: https://github.com/apache/rocketmq-dashboard/issues/1943
## Security regression The shared `UrlHostGuard` introduced for persisted data-source URLs, metrics queries, and LLM API bases resolves a hostname with `InetAddress.getByName`. That checks only one DNS answer. If a hostname has mixed results (for example, a public address plus link-local/cloud-metadata), validation can pass based on the first answer while the HTTP client performs an independent resolution and can connect to another. This is separate from #1543 / #1556: that fix made `SettingsService.isAllowedDataSourceHost` validate every answer for the connection-test path, but the newer shared guard used by save/query/LLM paths still validates one address. ## Expected behavior - Resolve all answers with `InetAddress.getAllByName`. - Reject the hostname if any answer violates the current any-local, link-local, or loopback policy. - Preserve the existing `allowLoopback` behavior for local LLM gateways. - Keep unresolvable hosts fail-closed. ## Proposed regression coverage Extract the address-array policy into a package-private helper and cover all-safe, mixed-safe/link-local, mixed-safe/loopback with both loopback policies, empty, and null address sets. ## Duplicate check Searched issues and PRs for `UrlHostGuard`, `getAllByName`, `all resolved`, and mixed DNS SSRF. Only #1543/#1556 were found; they change the separate `SettingsService` connection-test guard. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
