ChatGPT/FastGPT
1
0
Fork 0
mirror of https://github.com/labring/FastGPT.git synced 2025-07-23 13:03:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Check the url to avoid ssrf attacks (#3965)

Browse Source 
* fix: Check the url to avoid ssrf attacks

* Delete docSite/content/zh-cn/docs/development/upgrading/490.md
This commit is contained in:
Archer
2025-03-04 14:45:29 +08:00
committed by GitHub
parent e860c56b77
commit b4dda6a41b
4 changed files with 208 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
projects/app/src/pages/api/core/app/httpPlugin/getApiSchemaByUrl.ts
View File

@@ -1,18 +1,23 @@
import type { NextApiRequest, NextApiResponse } from 'next';
import { jsonRes } from '@fastgpt/service/common/response';
import { loadOpenAPISchemaFromUrl } from '@fastgpt/global/common/string/swagger';
import { NextAPI } from '@/service/middleware/entry';
import { CommonErrEnum } from '@fastgpt/global/common/error/code/common';
import { isInternalAddress } from '@fastgpt/service/common/system/utils';
export default async function handler(req: NextApiRequest, res: NextApiResponse<any>) {
try {
const apiURL = req.body.url as string;
async function handler(req: NextApiRequest, res: NextApiResponse<any>) {
const apiURL = req.body.url as string;
return jsonRes(res, {
data: await loadOpenAPISchemaFromUrl(apiURL)
});
} catch (err) {
jsonRes(res, {
code: 500,
error: err
});
if (!apiURL) {
return Promise.reject(CommonErrEnum.missingParams);
}
const isInternal = isInternalAddress(apiURL);
if (isInternal) {
return Promise.reject('Invalid url');
}
return await loadOpenAPISchemaFromUrl(apiURL);
}
export default NextAPI(handler);