pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-01 21:02:12 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): resolve SSRF vulnerability in sync-models via strict protocol and host validation

Browse Source
This commit is contained in:
diegosouzapw
2026-04-07 11:53:49 -03:00
parent 89c81bd88b
commit 60b632418f
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/app/api/providers/[id]/sync-models/route.ts
View File

@@ -147,8 +147,14 @@ export async function POST(request: Request, { params }: { params: Promise<{ id:
channelLabel = getModelSyncChannelLabel(connection);
// Fetch models from the existing /api/providers/[id]/models endpoint
const origin = new URL(request.url).origin;
const modelsUrl = `${origin}/api/providers/${encodeURIComponent(id)}/models`;
const parsedUrl = new URL(request.url);
if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
return NextResponse.json({ error: "Invalid protocol" }, { status: 400 });
}
if (parsedUrl.hostname.includes("..")) {
return NextResponse.json({ error: "Invalid hostname" }, { status: 400 });
}
const modelsUrl = `${parsedUrl.origin}/api/providers/${encodeURIComponent(id)}/models`;
const modelsRes = await fetch(modelsUrl, {
method: "GET",
headers: {