mirror of
https://github.com/DayuanJiang/next-ai-draw-io.git
synced 2026-09-02 01:20:23 +08:00
9feab38a0b
- Provider options, labels, and base-URL placeholders now come from PROVIDER_INFO instead of hand-copied lists (fixes SiliconFlow .com/.cn placeholder drift; panel names now match the model-config dialog) - Replace free-text subgroup strings + SUBGROUP_PROVIDERS reverse map with a typed provider field on SettingDef - Precompute SETTINGS_BY_GROUP and PROVIDER_SUBGROUPS at module level - Merge justSaved into saveMessage, drop unused mainRef, hoist fetchSettings out of the component, dedupe savedText logic - Serialize from SETTINGS_REGISTRY directly; json validators in a map instead of a hardcoded key check - Make allowPrivateUrls a function so ALLOW_PRIVATE_URLS edits in the admin panel apply without restart
90 lines
2.8 KiB
TypeScript
90 lines
2.8 KiB
TypeScript
/**
|
|
* SSRF (Server-Side Request Forgery) protection utilities
|
|
*/
|
|
|
|
/**
|
|
* Check if URL points to private/internal network
|
|
* Blocks: localhost, private IPs, link-local, AWS metadata service
|
|
*/
|
|
export function isPrivateUrl(urlString: string): boolean {
|
|
try {
|
|
const url = new URL(urlString)
|
|
// Strip a trailing dot so FQDN forms like "localhost." (which still
|
|
// resolve to 127.0.0.1) cannot bypass the equality checks below.
|
|
const hostname = url.hostname
|
|
.toLowerCase()
|
|
.replace(/^\[|\]$/g, "")
|
|
.replace(/\.$/, "")
|
|
|
|
// Block localhost
|
|
if (
|
|
hostname === "localhost" ||
|
|
hostname === "127.0.0.1" ||
|
|
hostname === "::1" ||
|
|
hostname === "::"
|
|
) {
|
|
return true
|
|
}
|
|
|
|
// Block IPv6 unique-local (fc00::/7), link-local (fe80::/10),
|
|
// and IPv4-mapped (::ffff:0:0/96) hosts.
|
|
if (hostname.includes(":")) {
|
|
if (
|
|
hostname.startsWith("fc") ||
|
|
hostname.startsWith("fd") ||
|
|
hostname.startsWith("::ffff:")
|
|
) {
|
|
return true
|
|
}
|
|
const linkLocal = hostname.match(/^fe([0-9a-f]{2}):/)
|
|
if (linkLocal) {
|
|
const high = parseInt(linkLocal[1], 16)
|
|
if (high >= 0x80 && high <= 0xbf) return true
|
|
}
|
|
}
|
|
|
|
// Block AWS/cloud metadata endpoints
|
|
if (
|
|
hostname === "169.254.169.254" ||
|
|
hostname === "metadata.google.internal"
|
|
) {
|
|
return true
|
|
}
|
|
|
|
// Check for private IPv4 ranges
|
|
const ipv4Match = hostname.match(
|
|
/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,
|
|
)
|
|
if (ipv4Match) {
|
|
const [, a, b] = ipv4Match.map(Number)
|
|
if (a === 10) return true // 10.0.0.0/8
|
|
if (a === 172 && b >= 16 && b <= 31) return true // 172.16.0.0/12
|
|
if (a === 192 && b === 168) return true // 192.168.0.0/16
|
|
if (a === 169 && b === 254) return true // 169.254.0.0/16 (link-local)
|
|
if (a === 127) return true // 127.0.0.0/8 (loopback)
|
|
}
|
|
|
|
// Block common internal hostnames
|
|
if (
|
|
hostname.endsWith(".local") ||
|
|
hostname.endsWith(".internal") ||
|
|
hostname.endsWith(".localhost")
|
|
) {
|
|
return true
|
|
}
|
|
|
|
return false
|
|
} catch {
|
|
return true // Invalid URL - block it
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Whether private URLs are allowed (defaults to true)
|
|
* Set ALLOW_PRIVATE_URLS=false to block private URLs
|
|
* Read per call so admin-panel changes apply without restart
|
|
*/
|
|
export function allowPrivateUrls(): boolean {
|
|
return process.env.ALLOW_PRIVATE_URLS !== "false"
|
|
}
|