ServletServerHttpRequest.getRemoteAddress() may perform DNS lookup

[slovdahl]

The ServletServerHttpRequest#getRemoteAddress method may perform a DNS lookup in certain scenarios (and same goes for its reactive counterpart).

If the underlying jakarta.servlet.ServletRequest#getRemoteHost implementation does a DNS lookup (as it is allowed, but not required to do), then calling ServletServerHttpRequest#getRemoteAddress will also do a DNS lookup. ServletServerHttpRequest#getRemoteAddress is for example called by Spring's ForwardedHeaderFilter.

As the ServletServerHttpRequest#getRemoteAddress return type is InetSocketAddress it feels like doing DNS resolution is quite pointless in general.

I have been trying to extract a minimal reproducer but I'm having some trouble getting it reproduced in a minimal setting. It might involve WebSocket via JSR 356 using Atmosphere and Jetty as the servlet container.

Similar to #28280.

[slovdahl]

Quoting #28280 (comment)

The AbstractStandardUpgradeStrategy still tries to get InetSocketAddresses during upgrade:

	@Override
  public void upgrade(ServerHttpRequest request, ServerHttpResponse response,
  		@Nullable String selectedProtocol, List<WebSocketExtension> selectedExtensions,
  		@Nullable Principal user, WebSocketHandler wsHandler, Map<String, Object> attrs)
  		throws HandshakeFailureException {

  	HttpHeaders headers = request.getHeaders();
  	InetSocketAddress localAddr = null;
  	try {
  		localAddr = request.getLocalAddress();
  	}
  	catch (Exception ex) {
  		// Ignore
  	}
  	InetSocketAddress remoteAddr = null;
  	try {
  		remoteAddr = request.getRemoteAddress();
  	}
  	catch (Exception ex) {
  		// Ignore
  	}

and ServerHttpRequest uses constructor of InetSocketAddress, which performs DNS lookup:

	@Override
  public InetSocketAddress getLocalAddress() {
  	return new InetSocketAddress(this.servletRequest.getLocalAddr(), this.servletRequest.getLocalPort());
  }

  @Override
  public InetSocketAddress getRemoteAddress() {
  	return new InetSocketAddress(this.servletRequest.getRemoteHost(), this.servletRequest.getRemotePort());
  }

(checked on spring 5.3.20 and java 17)

[github-actions]

Fixed via 2c83144

[slovdahl]

Thanks a lot @rstoyanchev for fixing this so quickly, much appreciated!