github-actions[bot] commented on code in PR #63817:
URL: https://github.com/apache/doris/pull/63817#discussion_r3400975642
##########
fe/fe-core/src/main/java/org/apache/doris/datasource/ExternalCatalog.java:
##########
@@ -328,16 +331,40 @@ public void checkWhenCreating() throws DdlException {
boolean testConnection = Boolean.parseBoolean(
catalogProperty.getOrDefault(TEST_CONNECTION,
String.valueOf(DEFAULT_TEST_CONNECTION)));
+ // SSRF: reject user-supplied URIs (HMS / HDFS / S3 endpoint / Iceberg
REST / Glue)
+ // that point at internal or loopback hosts. Always runs so attackers
cannot bypass
+ // by setting test_connection=false.
+ checkSsrf();
+
Review Comment:
This hook is not actually common to all external catalog creations.
`MaxComputeExternalCatalog.checkWhenCreating()` overrides this method and
returns immediately when `test_connection=false`, so
`mc.endpoint`/`mc.odps_endpoint`/`mc.tunnel_endpoint` can still be persisted as
loopback/private endpoints and are later used in `initLocalObjectsImpl()` via
`odps.setEndpoint(endpoint)`. Another catalog type that reaches this method,
`type=doris`, then skips in `checkSsrf()` because
`MetastoreProperties.create()` rejects `doris`; its `fe_http_hosts`,
`fe_thrift_hosts`, and `fe_arrow_hosts` are later used by
`RemoteDorisRestClient`, `FeServiceClient`, and Arrow Flight. This is distinct
from the annotation-audit thread because these catalog endpoints are not
represented by annotated `MetastoreProperties` fields at all. Please run SSRF
validation from a non-overridable common path or make each catalog-specific
creation path validate its own outbound host properties, and add negative tests
fo
r these non-MetastoreProperties catalog types.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
