| fix(security): strip forged X-Internal-Src header on external port and restore BUILD.bazel - http_iomgr.cpp: unconditionally erase X-Internal-Src before injecting it only for local connections, preventing external clients from forging the header to bypass IAM AKSK verification (critical security fix) - dual_port_e2e_test.cpp: add ExternalPortStripsForgedInternalSrcHeader test and HttpGetWithHeader helper to validate the header-stripping behaviour - tcpmgr.cpp: document why localAdvUrl is intentionally not registered with the routing layer (diagnostics-only, publishing it would undermine security) - module_switcher.cpp: extract localUrl variable and document that tcpLocalUrl and tcpLocalUrlAdv are intentionally identical for the loopback listener - vendor/cmake/datasystem.cmake: add bundled libssl.so.1.1 and libcrypto.so.1.1 to datasystem_LIB so the linker resolves OPENSSL_1_1_0 versioned symbols without conflicting with the vendor OpenSSL 3.0 libraries - functionsystem/src/common/proto/posix/BUILD.bazel: restore accidentally deleted Bazel build file for proto definitions Signed-off-by: Lwy_Robb <luowenyu4@huawei.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> | 2 个月前 |
