Copilot commented on code in PR #1188:
URL:
https://github.com/apache/flink-kubernetes-operator/pull/1188#discussion_r4535637439
##########
flink-kubernetes-operator/src/main/java/org/apache/flink/kubernetes/operator/artifact/HttpArtifactFetcher.java:
##########
@@ -264,4 +295,123 @@ private static boolean isRedirect(int status) {
|| status == 307 // Temporary Redirect
|| status == 308; // Permanent Redirect
}
+
+ @VisibleForTesting
+ static Optional<InetAddress> validateHop(
+ String uri, Collection<String> allowedSchemes, boolean
disallowRestrictedHosts)
+ throws IOException {
+ var validation =
+ JarUriValidationUtils.validateAndResolve(
+ uri, allowedSchemes, disallowRestrictedHosts);
+ if (validation.getError().isPresent()) {
+ throw new IOException(
+ "Refusing to fetch artifact from '"
+ + uri
+ + "': "
+ + validation.getError().get());
+ }
+ return validation.getCheckedAddress();
+ }
+
+ private static Proxy selectProxy(String uri) {
+ var selector = ProxySelector.getDefault();
+ var proxies = selector == null ? List.<Proxy>of() :
selector.select(URI.create(uri));
+ return proxies.isEmpty() ? Proxy.NO_PROXY : proxies.get(0);
+ }
+
+ private static HttpURLConnection openPinnedConnection(URL url, InetAddress
checkedAddress)
+ throws IOException {
+ // An address from getAllByName() keeps the hostname, which the JDK
would resolve again
+ // wherever it connects by host string, so connect by the raw IP only.
+ var address = InetAddress.getByAddress(checkedAddress.getAddress());
+ if ("https".equalsIgnoreCase(url.getProtocol())) {
+ // The URL keeps the hostname, so Host, SNI and the certificate
check still use it; only
+ // the TCP socket goes to the checked address.
+ var conn = (HttpsURLConnection) url.openConnection(Proxy.NO_PROXY);
+ conn.setSSLSocketFactory(
+ new PinnedSSLSocketFactory(conn.getSSLSocketFactory(),
address));
+ return conn;
+ }
+ // Plain HTTP has no socket hook, so the request goes to the address
as if it were a proxy:
+ // in absolute form, which servers must accept (RFC 9112, section
3.2.2), with Host still
+ // taken from the URL.
+ var port = url.getPort() == -1 ? url.getDefaultPort() : url.getPort();
+ return (HttpURLConnection)
+ url.openConnection(
+ new Proxy(Proxy.Type.HTTP, new
InetSocketAddress(address, port)));
Review Comment:
Treating the artifact origin as a proxy enables proxy authentication even
when the proxy selector chose DIRECT. If the JVM's default `Authenticator`
supplies proxy credentials, a tenant-controlled artifact host can return a
`407` challenge and receive them in `Proxy-Authorization`. Isolate this
synthetic-proxy connection from proxy authentication and cached proxy
credentials, or use a transport that pins the address without treating the
origin as a proxy, while preserving origin authentication and real-proxy
behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
