DNS Provider URL Validation

api/src/main/java/org/apache/cloudstack/api/command/user/dns/AddDnsServerCmd.java

@@ -46,7 +46,7 @@
         requestHasSensitiveInfo = true,
         responseHasSensitiveInfo = false,
         since = "4.23.0",
-        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+        authorized = {RoleType.Admin})
 public class AddDnsServerCmd extends BaseCmd {
 
     /////////////////////////////////////////////////////

api/src/main/java/org/apache/cloudstack/api/command/user/dns/DeleteDnsServerCmd.java

@@ -40,7 +40,7 @@
         entityType = {DnsServer.class},
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
         since = "4.23.0",
-        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+        authorized = {RoleType.Admin})
 public class DeleteDnsServerCmd extends BaseAsyncCmd {
 
     /////////////////////////////////////////////////////

api/src/main/java/org/apache/cloudstack/api/command/user/dns/UpdateDnsServerCmd.java

@@ -41,7 +41,7 @@
         entityType = {DnsServer.class},
         requestHasSensitiveInfo = true, responseHasSensitiveInfo = false,
         since = "4.23.0",
-        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+        authorized = {RoleType.Admin})
 public class UpdateDnsServerCmd extends BaseCmd {
 
     /////////////////////////////////////////////////////

server/src/main/java/org/apache/cloudstack/dns/DnsProviderManagerImpl.java

@@ -96,6 +96,7 @@
 import com.cloud.user.dao.AccountDao;
 import com.cloud.utils.Pair;
 import com.cloud.utils.StringUtils;
+import com.cloud.utils.UriUtils;
 import com.cloud.utils.component.ManagerBase;
 import com.cloud.utils.component.PluggableService;
 import com.cloud.utils.db.Filter;
@@ -107,9 +108,7 @@
 import com.cloud.vm.Nic;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineManager;
-import com.cloud.vm.dao.NicDao;
 import com.cloud.vm.dao.NicDetailsDao;
-import com.cloud.vm.dao.UserVmDao;
 import com.cloud.vm.dao.VMInstanceDao;
 
 @Component
@@ -126,10 +125,6 @@
     @Inject
     DnsZoneNetworkMapDao dnsZoneNetworkMapDao;
     @Inject
-    UserVmDao userVmDao;
-    @Inject
-    NicDao nicDao;
-    @Inject
     DomainDao domainDao;
     @Inject
     DnsZoneJoinDao dnsZoneJoinDao;
@@ -162,14 +157,36 @@
         throw new CloudRuntimeException("No plugin found for DNS provider type: " + type);
     }
 
+    /**
+     * Rejects a DNS provider URL that resolves to an illegal address before any provider client
+     * is given the chance to connect to it. See {@link UriUtils#validateUrl(String)} for the exact rules
+     * enforced (including the requirement that the URL declares an {@code http}/{@code https} scheme).
+     *
+     * @throws InvalidParameterValueException if the URL is blank, fails validation
+     */
+    private void validateDnsServerUrl(String trimmedUrl) {
+        if (StringUtils.isBlank(trimmedUrl)) {
+            throw new InvalidParameterValueException("URL cannot be blank.");
+        }
+        try {
+            UriUtils.validateUrl(trimmedUrl);
+        } catch (IllegalArgumentException e) {
+            throw new InvalidParameterValueException(e.getMessage());
+        }
+    }
+
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_DNS_SERVER_ADD, eventDescription = "Adding a DNS Server")
     public DnsServer addDnsServer(AddDnsServerCmd cmd) {
         Account caller = CallContext.current().getCallingAccount();
-        DnsServer existing = dnsServerDao.findByUrlAndAccount(cmd.getUrl(), caller.getId());
+        enforceRootAdminOnly(caller.getId());
+
+        String dnsUrl = StringUtils.trim(cmd.getUrl());
+        validateDnsServerUrl(dnsUrl);
+        DnsServer existing = dnsServerDao.findByUrlAndAccount(dnsUrl, caller.getId());
         if (existing != null) {
             throw new InvalidParameterValueException(
-                    "This Account already has a DNS server integration for URL: " + cmd.getUrl());
+                    "This Account already has a DNS server integration for URL: " + dnsUrl);
         }
 
         boolean isDnsPublic = cmd.isPublic();
@@ -190,7 +207,7 @@
         }
 
         DnsProviderType type = cmd.getProvider();
-        DnsServerVO server = new DnsServerVO(cmd.getName(), cmd.getUrl(), cmd.getPort(), type,
+        DnsServerVO server = new DnsServerVO(cmd.getName(), dnsUrl, cmd.getPort(), type,
                 cmd.getDnsUserName(), cmd.getDnsApiKey(), isDnsPublic, publicDomainSuffix, cmd.getNameServers(),
                 caller.getAccountId(), caller.getDomainId());
 
@@ -245,6 +262,8 @@
         }
 
         Account caller = CallContext.current().getCallingAccount();
+        enforceRootAdminOnly(caller.getId());
+
         accountMgr.checkAccess(caller, null, true, dnsServer);
 
         boolean validationRequired = false;
@@ -255,13 +274,15 @@
             dnsServer.setName(cmd.getName());
         }
 
-        if (cmd.getUrl() != null) {
-            if (!cmd.getUrl().equals(originalUrl)) {
-                DnsServer duplicate = dnsServerDao.findByUrlAndAccount(cmd.getUrl(), dnsServer.getAccountId());
+        if (StringUtils.isNotBlank(cmd.getUrl())) {
+            String dnsUrl = StringUtils.trim(cmd.getUrl());
+            if (!dnsUrl.equals(originalUrl)) {
+                validateDnsServerUrl(dnsUrl);
+                DnsServer duplicate = dnsServerDao.findByUrlAndAccount(dnsUrl, dnsServer.getAccountId());
                 if (duplicate != null && duplicate.getId() != dnsServer.getId()) {
                     throw new InvalidParameterValueException("Another DNS server with this URL already exists.");
                 }
-                dnsServer.setUrl(cmd.getUrl());
+                dnsServer.setUrl(dnsUrl);
                 validationRequired = true;
             }
         }
@@ -330,6 +351,7 @@
             throw new InvalidParameterValueException(String.format("DNS server with ID: %s not found.", dnsServerId));
         }
         Account caller = CallContext.current().getCallingAccount();
+        enforceRootAdminOnly(caller.getId());
         accountMgr.checkAccess(caller, null, true, dnsServer);
         return Transaction.execute((TransactionCallback<Boolean>) status -> {
             if (cmd.getCleanup()) {
@@ -1263,4 +1285,10 @@
             provider.addRecord(dnsServer, dnsZone, recordIpv6);
         }
     }
+
+    void enforceRootAdminOnly(Long callerId) {
+        if (!accountMgr.isRootAdmin(callerId)) {
+            throw new PermissionDeniedException("This API can only be called by root admin");
+        }
+    }
 }