Skip to content

[Improve][Manager] Fix the security vulnerability in /api/cluster/testConnection #12133

@fuweng11

Description

@fuweng11

Description

Currently, /api/cluster/testConnection does not perform role verification or SSRF verification. To fix this issue, it is necessary to add relevant verifications to this API.

Fix the security vulnerability in /api/cluster/testConnection.

  1. Add @RequiresRoles to testConnection consistent with other data node
    management operations.
  2. Extend UrlVerificationUtils to deny link-local, loopback, and RFC 1918
    address ranges.
  3. Configure RestTemplate instances used by HTTP-based operators to reject
    SSRF-prone targets before connecting.

InLong Component

InLong Manager

Are you willing to submit PR?

  • Yes, I am willing to submit a PR!

Code of Conduct

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions