Description
Currently, /api/cluster/testConnection does not perform role verification or SSRF verification. To fix this issue, it is necessary to add relevant verifications to this API.
Fix the security vulnerability in /api/cluster/testConnection.
- Add @RequiresRoles to testConnection consistent with other data node
management operations.
- Extend UrlVerificationUtils to deny link-local, loopback, and RFC 1918
address ranges.
- Configure RestTemplate instances used by HTTP-based operators to reject
SSRF-prone targets before connecting.
InLong Component
InLong Manager
Are you willing to submit PR?
Code of Conduct
Description
Currently, /api/cluster/testConnection does not perform role verification or SSRF verification. To fix this issue, it is necessary to add relevant verifications to this API.
Fix the security vulnerability in /api/cluster/testConnection.
management operations.
address ranges.
SSRF-prone targets before connecting.
InLong Component
InLong Manager
Are you willing to submit PR?
Code of Conduct