{"record":{"id":"7f40c1f2140aab01","repo":"apache/shenyu","slug":"access-to-sensitive-ports-is-not-allowed","errorCode":null,"errorMessage":"Access to sensitive ports is not allowed","messagePattern":"Access to sensitive ports is not allowed","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java","lineNumber":97,"sourceCode":"        if (Objects.isNull(host) || host.trim().isEmpty()) {\n            throw new IllegalArgumentException(\"Host cannot be empty\");\n        }\n\n        String normalizedHost = host.toLowerCase().trim();\n\n        // Check for localhost variations\n        if (isLocalhost(normalizedHost)) {\n            throw new IllegalArgumentException(\"Access to localhost is not allowed\");\n        }\n\n        // Check for private IP addresses\n        if (isPrivateOrInternalIP(normalizedHost)) {\n            throw new IllegalArgumentException(\"Access to private or internal IP addresses is not allowed\");\n        }\n\n        // Check for sensitive ports\n        if (isSensitivePort(port)) {\n            throw new IllegalArgumentException(\"Access to sensitive ports is not allowed\");\n        }\n\n        // Additional validation for DNS resolution\n        try {\n            InetAddress[] addresses = InetAddress.getAllByName(normalizedHost);\n            for (InetAddress address : addresses) {\n                if (address.isLoopbackAddress() || address.isLinkLocalAddress()\n                        || address.isSiteLocalAddress() || address.isAnyLocalAddress()) {\n                    throw new IllegalArgumentException(\"Resolved IP address is not allowed: \" + address.getHostAddress());\n                }\n\n                // Check resolved IP against private ranges\n                if (isPrivateIPAddress(address.getHostAddress())) {\n                    throw new IllegalArgumentException(\"Resolved IP address is private: \" + address.getHostAddress());\n                }\n            }\n        } catch (UnknownHostException e) {\n            throw new IllegalArgumentException(\"Cannot resolve host: \" + host);","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/UrlSecurityUtils.java#L79-L115","documentation":"UrlSecurityUtils.validateHostForSSRF throws this IllegalArgumentException when the URL's port is in the sensitive-port list (well-known service ports such as 22, 3306, 6379, etc.). This blocks SSRF attempts that abuse the admin server to probe or attack local infrastructure services. The check runs after the private-IP check and before DNS resolution.","triggerScenarios":"Calling validateUrlForSSRF with a URL whose parsed port equals a sensitive port, e.g. http://example.com:6379/ or an explicit :22/:3306/:9095 port.","commonSituations":"Developers configuring internal service endpoints with database or Redis ports, or testing SSRF protections by pointing URLs at local daemons on default ports.","solutions":["Serve the target endpoint on a standard HTTP port (80/443) or a non-sensitive port.","If the port is legitimate for your deployment, front the service with a reverse proxy on an allowed port.","Review the sensitive-port list in UrlSecurityUtils to confirm which ports are blocked; do not remove entries in production."],"exampleFix":"// before\nUrlSecurityUtils.validateUrlForSSRF(\"http://backend.internal:3306/query\");\n// after\nUrlSecurityUtils.validateUrlForSSRF(\"https://backend.example.com/query\");","handlingStrategy":"validation","validationCode":"Set<Integer> SENSITIVE = Set.of(22, 23, 25, 3306, 6379, 8086, 9200, 27017, 9095);\nint port = uri.getPort() == -1 ? defaultPort : uri.getPort();\nif (SENSITIVE.contains(port)) { throw new IllegalArgumentException(\"sensitive port \" + port); }","typeGuard":"boolean isAllowedPort(int port) {\n    return port == 80 || port == 443 || (port >= 1024 && !SENSITIVE.contains(port));\n}","tryCatchPattern":"try {\n    UrlSecurityUtils.validateUrlForSSRF(url);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Port or host not allowed: {}\", e.getMessage());\n}","preventionTips":["Serve backend endpoints behind 80/443 via reverse proxy.","Never expose databases/Redis on ports referenced by gateway URLs.","Lint configured URLs for explicit sensitive ports before persisting."],"tags":["ssrf","security","port","url-validation"],"backgroundTag":"invalid-url","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}