unbridled-41 commented on PR #2833:
URL:
https://github.com/apache/rocketmq-dashboard/pull/2833#issuecomment-5467509810
Additional verification for reviewers — end-to-end primitive check with the
**real RocketMQ client, no mocks**:
```
$ java SsrfPrimitiveProof
[*] trap listener on 127.0.0.1:37161
[*] forged offset msgId: 7F00000100009129000000000000002A //
127.0.0.1:37161 + offset 42
[!] TRAP HIT: studio-side remoting client connected, first bytes read = 64
[*] viewMessage failed as expected after connecting
```
A plain `DefaultMQAdminExt` (NameServer configured to an unreachable
`127.0.0.1:1`) calling `viewMessage("TopicA", forgedMsgId)` accepted a TCP
connection on the trap socket and sent a 64-byte remoting request — i.e. the
pre-fix primary path connects to the address carried inside the msgId,
independent of the NameServer and of any topology check. That is the behavior
the guard now blocks before remoting (asserted with `verify(adminExt,
never()).viewMessage(...)`).
Also re-ran the full suite on the unmodified branch as a control for the one
failure mentioned in the PR body (result to follow in a thread if useful).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
