i/next-ai-draw-io
1
0
Fork 0
mirror of https://github.com/DayuanJiang/next-ai-draw-io.git synced 2026-09-02 17:40:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #662 from DayuanJiang/fix/ollama-ssrf-exception

Browse Source 
Adds Ollama to SSRF protection exception list
This commit is contained in:
Dayuan Jiang
2026-01-29 21:56:54 +09:00
committed by GitHub
parent fdd4be6463 09a5774cba
commit 6dad6ab147
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
lib/ai-providers.ts
View File

@@ -572,12 +572,13 @@ export function getAIModel(overrides?: ClientOverrides): ModelConfig {
// SECURITY: Prevent SSRF attacks (GHSA-9qf7-mprq-9qgm)
// If a custom baseUrl is provided, an API key MUST also be provided.
// This prevents attackers from redirecting server API keys to malicious endpoints.
// Exception: EdgeOne provider doesn't require API key (uses Edge AI runtime)
// Exception: EdgeOne and Ollama providers don't require API keys
if (
overrides?.baseUrl &&
!overrides?.apiKey &&
!(overrides?.provider === "vertexai" && overrides?.vertexApiKey) &&
overrides?.provider !== "edgeone"
overrides?.provider !== "edgeone" &&
overrides?.provider !== "ollama"
) {
throw new Error(
`API key is required when using a custom base URL. ` +