* fix: SSRF vulnerability in HTTP Tool (GHSA-6g6x-8hq5-9cw4) 修复 HTTP Tool 中的 SSRF 漏洞,防止攻击者访问内部网络资源。 主要变更: 1. 在 runHTTPTool 函数中添加 isInternalAddress 验证 2. 修改 CHECK_INTERNAL_IP 默认行为为启用(安全优先) 3. 添加全面的单元测试验证修复 安全改进: - 阻止访问 AWS/GCP/Azure 等云服务商元数据端点 - 阻止访问 Kubernetes 服务端点 - 阻止访问私有 IP 范围 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) - 阻止访问 localhost 和 127.0.0.1 - 阻止访问 link-local 地址 (169.254.0.0/16) 破坏性变更: - CHECK_INTERNAL_IP 环境变量默认值从 false 改为 true - 需要访问内部服务的用户需要显式设置 CHECK_INTERNAL_IP=false(不推荐) 测试: - 添加 23 个测试用例覆盖各种 SSRF 攻击场景 - 所有测试通过 相关问题: - Fixes GHSA-6g6x-8hq5-9cw4 - CWE-918: Server-Side Request Forgery Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * test: update isInternalAddress tests for new default behavior 更新测试以反映 CHECK_INTERNAL_IP 的新默认行为(默认启用安全检查)。 变更: - 修改默认行为测试:现在默认阻止私有 IP 地址 - 添加 CHECK_INTERNAL_IP=false 测试组:测试向后兼容模式 - 所有 62 个测试通过 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * doc --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
FastGPT
English | 简体中文 | Bahasa Indonesia | ไทย | Tiếng Việt | 日本語
FastGPT is an AI Agent building platform that provides out-of-the-box capabilities for data processing and model invocation. It also enables workflow orchestration through Flow visualization, allowing you to achieve complex application scenarios!
https://github.com/labring/FastGPT/assets/15308462/7d3a38df-eb0e-4388-9250-2409bd33f6d4
Quick Start
You can quickly start FastGPT using Docker. Run the following command in your terminal and follow the prompts to pull the configuration.
# Run the command to pull the configuration file
bash <(curl -fsSL https://doc.fastgpt.cn/deploy/install.sh)
# Start the service
docker compose up -d
After fully started, you can access FastGPT at http://localhost:3000. The default account is root and the password is 1234.
If you encounter any issues, you can view the complete Docker deployment tutorial
🛸 Usage
-
Cloud Version
If you don't need private deployment, you can directly use our cloud service at: fastgpt.io -
Community Self-Hosted Version
You can quickly deploy using Docker or use Sealos Cloud to deploy FastGPT with one click. -
Commercial Version
If you need more complete features or in-depth service support, you can choose our Commercial Version. In addition to providing complete software, we also offer implementation guidance for specific scenarios. You can submit a commercial consultation.
💡 Core Features
![]() |
![]() |
![]() |
![]() |
1 Application Orchestration
- Planning Agent mode.
- Dialogue workflow, plugin workflow, including basic RPA nodes.
- User interaction
- Bidirectional MCP
- Assisted workflow generation
2 Application Debugging
- Knowledge base single-point search testing
- Reference feedback during conversation with edit and delete capabilities
- Complete call chain logs
- Application evaluation
- Advanced orchestration DeBug mode
- Application node logs
3 Knowledge Base
- Multi-database reuse and mixing
- Chunk record modification and deletion
- Support for manual input, direct segmentation, QA split import
- Support for txt, md, html, pdf, docx, pptx, csv, xlsx (more can be PR'd), support for URL reading & CSV batch import
- Hybrid retrieval & reranking
- API knowledge base
- RAG module hot-swapping
4 OpenAPI Interface
- Completions interface (aligned with GPT chat mode)
- Knowledge base CRUD
- Dialogue CRUD
- Automated OpenAPI interface
5 Operations Features
- Login-free sharing window
- One-click Iframe embedding
- Unified dialogue record review with data annotation
- Application operation logs
6 Others
- Visual model configuration.
- Voice input and output support (configurable)
- Fuzzy input hints
- Template marketplace
💪 Our Projects & Links
- Quick Start Local Development
- OpenAPI Documentation
- FastGPT-plugin
- AI Proxy: Model Aggregation Load Balancing Service
- Laf: Quick 3-Minute Access to Third-Party Applications
- Sealos: Quick Cluster Application Deployment
🌿 Third-party Ecosystem
- AI Proxy: Large Model Aggregation Service
- SiliconCloud - Open Source Model Online Experience Platform
- PPIO: One-click Call to Cost-effective Open Source Model API and GPU Containers
🏘️ Community
Join our Feishu group:
🤝 Contributors
We warmly welcome contributions in various forms. If you're interested in contributing code, check out our GitHub Issues and show us your brilliant ideas!
|
|
|
|---|---|
|
|
|
|
|
|
🌟 Star History
License
This repository follows the FastGPT Open Source License.
- Commercial use as backend services is allowed, but SaaS services are not permitted.
- Any commercial services without commercial authorization must retain the relevant copyright information.
- Please see FastGPT Open Source License for full details.
- Contact: Dennis@sealos.io, View Commercial Pricing




