mirror of
https://github.com/DayuanJiang/next-ai-draw-io.git
synced 2026-10-11 03:59:58 +08:00
dayuan.jiang
4731394f32
- Bedrock: a request's AWS region must be a region name. It becomes part of the endpoint's host name, so a value such as "us-east-1.attacker.example/" sent the server's bearer token or signed request to another host. - MCP preview server: only the preview page itself (Origin equal to the Host) or a non-browser client may call it; a page on another localhost port could replace the diagram with a plain text POST. History builds its thumbnails element by element and shows only SVG data images, so a stored value can no longer run script in the preview. - chat, validate-model, validate-diagram, provider-models and parse-url take JSON bodies only, so another website cannot make the user's own server (the desktop app, a local install) run models with their keys; the desktop app also refuses a foreign Host (DNS rebinding). - The model list reads at most 2 MB, also through the Gateway SDK, and answers only with its own error texts: the URL is the caller's and may be an internal address. - An admin panel provider with its own key and no URL no longer inherits the global <P>_BASE_URL, which may be a proxy for another key; OpenAI then gets the official endpoint, as its Test. Azure keeps the server's resource.
82 lines
2.6 KiB
TypeScript
82 lines
2.6 KiB
TypeScript
import { NextResponse } from "next/server"
|
|
import { checkAccessCode, rejectCrossSite } from "@/lib/access-code"
|
|
import { classifyLLMError } from "@/lib/llm-errors"
|
|
import {
|
|
canListModels,
|
|
listProviderModels,
|
|
ModelListError,
|
|
} from "@/lib/provider-models"
|
|
import {
|
|
allowPrivateUrls,
|
|
isPrivateUrl,
|
|
redirectGuardedFetch,
|
|
} from "@/lib/ssrf-protection"
|
|
import type { ProviderName } from "@/lib/types/model-config"
|
|
|
|
export const runtime = "nodejs"
|
|
|
|
// Public lists need no key
|
|
const NO_KEY_NEEDED = new Set<ProviderName>([
|
|
"ollama",
|
|
"openrouter",
|
|
"aihubmix",
|
|
])
|
|
|
|
/**
|
|
* The models a provider offers, for the "Fetch models" button in model
|
|
* settings. Answers { models: null } for providers that cannot list them,
|
|
* so the dialog keeps its suggested models.
|
|
*/
|
|
export async function POST(req: Request) {
|
|
const crossSite = rejectCrossSite(req)
|
|
if (crossSite) return crossSite
|
|
// Sends requests to a URL the client chose, so require the access code
|
|
const accessError = checkAccessCode(req)
|
|
if (accessError) return accessError
|
|
|
|
const { provider, apiKey, baseUrl } = (await req.json()) as {
|
|
provider: ProviderName
|
|
apiKey?: string
|
|
baseUrl?: string
|
|
}
|
|
if (!canListModels(provider)) {
|
|
return NextResponse.json({ models: null })
|
|
}
|
|
// SECURITY: Block SSRF attacks via custom baseUrl
|
|
if (baseUrl && !allowPrivateUrls() && (await isPrivateUrl(baseUrl))) {
|
|
return NextResponse.json({ error: "Invalid base URL" }, { status: 400 })
|
|
}
|
|
if (!apiKey && !NO_KEY_NEEDED.has(provider)) {
|
|
return NextResponse.json(
|
|
{ error: "API key is required" },
|
|
{ status: 400 },
|
|
)
|
|
}
|
|
|
|
try {
|
|
const models = await listProviderModels(
|
|
provider,
|
|
{ apiKey, baseUrl },
|
|
(baseUrl && redirectGuardedFetch()) || fetch,
|
|
)
|
|
return NextResponse.json({ models })
|
|
} catch (error) {
|
|
console.warn("[provider-models] Listing failed:", error)
|
|
// Only our own explanations go back: the URL may be an internal
|
|
// address, whose answer or host names must not reach the caller.
|
|
// The Gateway SDK wraps them, keeping ours as the cause.
|
|
const cause = (error as { cause?: unknown })?.cause
|
|
const own =
|
|
error instanceof ModelListError
|
|
? error
|
|
: cause instanceof ModelListError
|
|
? cause
|
|
: null
|
|
const { code } = classifyLLMError(own ?? error)
|
|
return NextResponse.json({
|
|
code,
|
|
error: own?.message ?? "The model list request failed.",
|
|
})
|
|
}
|
|
}
|