Description
POST /api/node/testConnection is vulnerable to SSRF. DataNodeServiceImpl.testConnection only validates DataNodeRequest.url via UrlVerificationUtils.validateUrlNotInternal, but each operator connects using its own field, which is never validated.
InLong Component
InLong Manager
Are you willing to submit PR?
Code of Conduct
Description
POST /api/node/testConnection is vulnerable to SSRF. DataNodeServiceImpl.testConnection only validates DataNodeRequest.url via UrlVerificationUtils.validateUrlNotInternal, but each operator connects using its own field, which is never validated.
InLong Component
InLong Manager
Are you willing to submit PR?
Code of Conduct