New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
#21415 blocking remote calls to private subnets #21427
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The logic in CircuitBreakerUrl.java and XmlTool.java should have tests
…ssue-21415-xmltool
} | ||
|
||
@Test | ||
public void test_xmltool_using_private_ip_should_throw_an_exception() { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
doc
} | ||
} | ||
|
||
@Test |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
doc
setRoot(reader.read(url)); | ||
|
||
|
||
if(IPUtils.isIpPrivateSubnet(url.getHost()) && !Config.getBooleanProperty("ALLOW_ACCESS_TO_PRIVATE_SUBNETS", false)){ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
maybe we should use a util class for this logic, maybe in IPUtils
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
probably in IPUtils
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would encapsulate the Config call in a Lazy
@@ -193,6 +194,11 @@ public void doOut(final HttpServletResponse response) throws IOException { | |||
.setConnectionRequestTimeout(Math.toIntExact(this.timeoutMs)) | |||
.setSocketTimeout(Math.toIntExact(this.timeoutMs)).build(); | |||
try (CloseableHttpClient httpclient = HttpClientBuilder.create().setDefaultRequestConfig(config).build()) { | |||
|
|||
if(IPUtils.isIpPrivateSubnet(this.request.getURI().getHost()) && !Config.getBooleanProperty("ALLOW_ACCESS_TO_PRIVATE_SUBNETS", false)){ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would encapsulate the Config call in a Lazy
No description provided.