yangjj-iso opened a new pull request, #7868:
URL: https://github.com/apache/shenyu/pull/7868
Fixes #7595.
Swagger import, MCP import and connection testing rejected public HTTP
services on 8080/8081/9090/9091. They now permit these application ports by
default and share a configurable port policy. An empty
`shenyu.swagger.allowed-ports` permits any non-denied port; `denied-ports`
replaces the infrastructure-port defaults and takes precedence. Configured
ports outside 1–65535 fail binding. The application configuration documents the
policy.
Resolve each request destination once, validate every returned address and
pass an immutable, hostname-restricted DNS result into the actual OkHttp
request. The dedicated document fetch disables proxies and both redirect types
and uses an isolated zero-idle connection pool so another client's connection
cannot bypass the validated resolution. Preserve the original hostname for HTTP
Host and HTTPS certificate/SNI handling. Private, loopback, link-local,
unspecified, multicast, IPv6 unique-local and shared-address destinations
remain blocked even when a port is allowed; mixed public/private DNS responses
fail closed.
The general HttpUtils methods retain their existing internal-upstream and
redirect behavior. Keep the existing two-argument programmatic service
constructor with default policy; Spring injects the configured policy.
Validation failures retain IllegalArgumentException and connection testing
still returns false. Body-size limits and response closure remain in place. A
neighboring file-helper test now uses URL.toURI() so its resource lookup works
in checkout paths containing spaces.
Validation on Microsoft OpenJDK 17.0.18, through the Maven wrapper:
- Before the fix, all four new application-port cases failed against the
original implementation; the existing parser-confusion regression passed.
- After the fix, 101 focused tests passed with zero failures, errors or
skips. Coverage includes all three service paths, default/configured port
policy, configuration binding, private and alternate IP forms, mixed DNS
answers, IPv6 ULA/multicast, immutable DNS snapshots and resolver failures.
- Real HTTP transport tests use a local server and a recording socket
factory: they verify the selected address stays pinned despite a changing
resolver, an existing unvalidated pooled connection is not reused, the Host
header is preserved, inherited proxies are bypassed and a redirect never
reaches its internal target.
- Existing Swagger controller, MCP registration, response-size and generic
HttpUtils tests pass.
- Checkstyle, Apache RAT and git diff --check pass.
```sh
./mvnw -B -ntp -pl shenyu-admin -am test apache-rat:check \
-Dtest=UrlSecurityUtilsTest,ValidatedHttpRequestTest,SwaggerImportPropertiesTest,SwaggerImportServiceTest,SwaggerImportServiceImplTest,SwaggerImportControllerTest,HttpUtilsTest
\
-Dsurefire.failIfNoSpecifiedTests=false -DskipRemoteResources=true \
-Djacoco.skip=true -Dmaven.javadoc.skip=true
```
No live external DNS-rebinding service or Docker E2E environment was used.
DNS changes and transport destination selection are tested deterministically
without external network access; full-repository checks remain with CI.
- [x] Read the contribution guidelines.
- [x] Add regression coverage.
- [ ] Full-repository clean install with all tests (affected-reactor
validation is recorded above).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
