JanusGraph / JanusGraph/janusgraph
Address DNS vunerabilities
- Dominant language
- Java
- Stars
- 5.8k
- Forks
- 1.2k
- Avg merge
- 13h 53m
- Merged PRs (30d)
- 6
Description
Fortify - High - DNS can be spoofed - should pass in IP addresses instead.
1. [CheckSocket](https://github.com/JanusGraph/janusgraph/blob/84ead7d/janusgraph-core/src/main/java/org/janusgraph/util/system/CheckSocket.java#L46)
2. [GraphDatabaseConfiguration](https://github.com/JanusGraph/janusgraph/blob/84ead7d/janusgraph-core/src/main/java/org/janusgraph/graphdb/configuration/GraphDatabaseConfiguration.java#L1522)
3. [NetworkUtil](https://github.com/JanusGraph/janusgraph/blob/84ead7d/janusgraph-core/src/main/java/org/janusgraph/util/system/NetworkUtil.java#L30)
4. [NetworkUtil](https://github.com/JanusGraph/janusgraph/blob/84ead7d/janusgraph-core/src/main/java/org/janusgraph/util/system/NetworkUtil.java#L38)
5. [NetworkUtil](https://github.com/JanusGraph/janusgraph/blob/84ead7d/janusgraph-core/src/main/java/org/janusgraph/util/system/NetworkUtil.java#L45)
6. [NetworkUtil](https://github.com/JanusGraph/janusgraph/blob/84ead7d/janusgraph-core/src/main/java/org/janusgraph/util/system/NetworkUtil.java#L49)
7. [NetworkUtil](https://github.com/JanusGraph/janusgraph/blob/84ead7d/janusgraph-core/src/main/java/org/janusgraph/util/system/NetworkUtil.java#L59)
8. [NetworkUtil](https://github.com/JanusGraph/janusgraph/blob/84ead7d/janusgraph-core/src/main/java/org/janusgraph/util/system/NetworkUtil.java#L60)
9. [NetworkUtil](https://github.com/JanusGraph/janusgraph/blob/84ead7d/janusgraph-core/src/main/java/org/janusgraph/util/system/NetworkUtil.java#L61)
Contributor guide
Research direction
Start by reviewing the referenced locations in CheckSocket.java, GraphDatabaseConfiguration.java, and NetworkUtil.java, especially the listed NetworkUtil lines, to map where DNS-based values are used. The work is done when the listed vulnerability paths consistently use IP addresses instead of DNS names and the relevant existing checks pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100