ext/new-api
2
0
Fork 0
mirror of https://github.com/QuantumNous/new-api.git synced 2026-09-14 00:01:53 +00:00
Code Activity

feat(ssrf): implement SSRF protection in HTTP clients and validation functions

Browse Source
This commit is contained in:
CaIon
2026-07-06 14:52:01 +08:00
parent 1e11dfcfb5
commit df087b022d
10 changed files with 799 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
service/download.go
+3 -4
View File
@@ -41,7 +41,7 @@ func DoWorkerRequest(req *WorkerRequest) (*http.Response, error) {
}
// 序列化worker请求数据
workerPayload, err := json.Marshal(req)
workerPayload, err := common.Marshal(req)
if err != nil {
return nil, fmt.Errorf("failed to marshal worker payload: %v", err)
}
@@ -59,12 +59,11 @@ func DoDownloadRequest(originUrl string, reason ...string) (resp *http.Response,
return DoWorkerRequest(req)
} else {
// SSRF防护：验证请求URL（非Worker模式）
fetchSetting := system_setting.GetFetchSetting()
if err := common.ValidateURLWithFetchSetting(originUrl, fetchSetting.EnableSSRFProtection, fetchSetting.AllowPrivateIp, fetchSetting.DomainFilterMode, fetchSetting.IpFilterMode, fetchSetting.DomainList, fetchSetting.IpList, fetchSetting.AllowedPorts, fetchSetting.ApplyIPFilterForDomain); err != nil {
if err := ValidateSSRFProtectedFetchURL(originUrl); err != nil {
return nil, fmt.Errorf("request reject: %v", err)
}
common.SysLog(fmt.Sprintf("downloading from origin: %s, reason: %s", common.MaskSensitiveInfo(originUrl), strings.Join(reason, ", ")))
return GetHttpClient().Get(originUrl)
return GetSSRFProtectedHTTPClient().Get(originUrl)
}
}