dashboard: Add IP validation in MachineRegistryController

* Fixes alibaba#2451 Signed-off-by: Eric Zhao <sczyh16@gmail.com>
Zhang-0952 · Nov 19, 2021 · 518e652 · 518e652
1 parent 40651ec
commit 518e652
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/...rc/main/java/com/alibaba/csp/sentinel/dashboard/controller/MachineRegistryController.java b/...rc/main/java/com/alibaba/csp/sentinel/dashboard/controller/MachineRegistryController.java
@@ -29,6 +29,7 @@
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.ResponseBody;
+import sun.net.util.IPAddressUtil;
 
 @Controller
 @RequestMapping(value = "/registry", produces = MediaType.APPLICATION_JSON_VALUE)
@@ -51,6 +52,9 @@ public Result<?> receiveHeartBeat(String app,
         if (StringUtil.isBlank(ip) || ip.length() > 128) {
             return Result.ofFail(-1, "invalid ip: " + ip);
         }
+        if (!IPAddressUtil.isIPv4LiteralAddress(ip) && !IPAddressUtil.isIPv6LiteralAddress(ip)) {
+            return Result.ofFail(-1, "invalid ip: " + ip);
+        }
         if (port == null || port < -1) {
             return Result.ofFail(-1, "invalid port");
         }