btlqql opened a new pull request, #2304: URL: https://github.com/apache/rocketmq-dashboard/pull/2304
## What is the purpose of the change UrlHostGuard is the shared SSRF guard for server-side HTTP endpoints that accept caller-supplied URLs (metrics data sources, LLM gateways). `InetAddress.isLinkLocalAddress()` and `isSiteLocalAddress()` do not classify IPv6 unique-local addresses (fc00::/7) as local, so they currently pass the guard. This includes the AWS EC2 IMDS IPv6 metadata endpoint (`fd00:ec2::254`), which the guard's documented contract claims to block. ## Brief changelog - `UrlHostGuard.areAllowed` now rejects IPv6 unique-local addresses (fc00::/7) in addition to loopback, link-local, any-local and multicast addresses, even when loopback is permitted. - Added unit tests for ULA rejection (fd00:ec2::254, fc00::1), global IPv6 acceptance, and `isAllowedHost` with an IPv6 ULA literal. ## How was this patch verified - `mvn -Dtest=UrlHostGuardTest test` -> 5/5 passed - `git diff --check` clean -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
