lizhimins commented on PR #4205:
URL:
https://github.com/apache/rocketmq-dashboard/pull/4205#issuecomment-5694500486
Closing: this has the same design problems we raised on #4182, which is back
with its author. Broker hostnames are resolved inside the synchronous request
thread with no timeout and no cache, DNS becomes the trust anchor for a
topology check, and the existing `UrlHostGuard.areAllowed` is not reused.
Three further issues: `knownBrokerEndpoints` resolves every registered
address unconditionally (rather than only after an exact match fails) and is
called from inside the unbounded per-message loop in `RocketMQDLQProvider`, so
a DLQ scan can issue N x M blocking lookups; `getByName` only uses the first A
record, so a hostname with several records is still rejected; and `catch
(Exception) { return null; }` swallows failures silently even though the class
is annotated `@Slf4j`. The second test passes with the fix reverted.
We think the whole area needs a topology snapshot layer with its own timeout
and cache rather than another call-site guard.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
