RockteMQ-AI commented on code in PR #2362:
URL:
https://github.com/apache/rocketmq-dashboard/pull/2362#discussion_r3822513790
##########
server/src/main/java/org/apache/rocketmq/studio/instance/acl/IpRangeMatcher.java:
##########
@@ -105,23 +107,37 @@ public static boolean isInRange(String ip, String
cidrOrIp) {
}
/**
- * Converts a validated dotted-quad IPv4 literal to its 4-byte
representation.
- * Callers must ensure the input passes {@link #isIpv4Literal(String)}
first.
+ * Parses an IPv4 or IPv6 literal without resolving hostnames. IPv6 input
is restricted to
+ * address-literal characters before using {@link
InetAddress#getByName(String)}, so this path
+ * cannot issue a DNS query. Scoped addresses are intentionally rejected
because interface
+ * names are host-specific and cannot form portable ACL entries.
*/
- private static byte[] ipToBytes(String ip) {
- String[] parts = ip.split("\\.");
- byte[] bytes = new byte[4];
- for (int i = 0; i < 4; i++) {
- bytes[i] = (byte) Integer.parseInt(parts[i]);
+ private static byte[] parseAddressLiteral(String value) {
+ if (isIpv4Literal(value)) {
+ String[] parts = value.split("\\.");
+ byte[] bytes = new byte[4];
+ for (int i = 0; i < bytes.length; i++) {
+ bytes[i] = (byte) Integer.parseInt(parts[i]);
+ }
+ return bytes;
+ }
+ if (value == null || !value.contains(":")
+ || !IPV6_LITERAL_CHARACTERS.matcher(value).matches()) {
+ return null;
Review Comment:
**[Info]** `InetAddress.getByName(value)` is guarded by the
`IPV6_LITERAL_CHARACTERS` regex which prevents DNS resolution — good. One minor
note: Java's `InetAddress.getByName` for IPv6 literals can internally normalize
mapped addresses (e.g. `::ffff:192.168.1.1` returns a 4-byte `Inet4Address`).
The `instanceof Inet6Address` check on line 127 correctly rejects those, so
IPv4-mapped IPv6 entries silently return `null`. This is safe but worth a
comment for future maintainers.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
