tju-yxq commented on issue #1609: URL: https://github.com/apache/rocketmq-dashboard/issues/1609#issuecomment-5269874275
Follow-up audit note: This is fixed in current `rocketmq-studio`. The settings data source path uses `DataSourceClientHttpRequestFactory`, and `DataSourceClientHttpRequestFactoryTest#prepareConnectionShouldDisableRedirectsTest` verifies that per-connection redirect following is disabled. I also re-ran the settings factory test together with the related metrics/proxy no-redirect factory tests and proxy service tests: ```bash cd server mvn -DskipTests=false "-Dtest=DataSourceClientHttpRequestFactoryTest,org.apache.rocketmq.studio.cluster.metrics.NoRedirectClientHttpRequestFactoryTest,org.apache.rocketmq.studio.cluster.proxy.NoRedirectClientHttpRequestFactoryTest,ProxyAddressServiceTest" test ``` Result: `BUILD SUCCESS`; `Tests run: 13, Failures: 0, Errors: 0, Skipped: 0`. I updated the issue description to remove the earlier unverified live redirect/internal-service reproduction language. This was verified by code inspection and focused unit tests, not by a live SSRF exploit reproduction. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
