pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-23 23:52:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): match client-API aliases case-insensitively in the authz matcher

Browse Source 
Next compiles the proxy matcher from `regexp.source` only, dropping
path-to-regexp's case-insensitive flag, so `/v1/:path*` never matched `/V1/...`
while the rewrite layer (flag kept) still routed it to the handler — an
unauthenticated inference bypass via uppercase / mixed-case paths (/V1, /V1BETA,
/CHAT, /RESPONSES, /CODEX, /MODELS). Expressing the casing inside a
path-to-regexp custom group (`([vV]1)`) survives the flag-drop. classify.ts
normalizes the control segment case so uppercase aliases resolve to CLIENT_API
(honoring REQUIRE_API_KEY) instead of the management fallback.

Reported by @Evgeny-SPB via GHSA-jvqc-mp9f-q936.
This commit is contained in:
Xiangzhe
2026-08-21 13:14:53 -03:00
parent 49a4ad31e4
commit a2d5ef50f4
4 changed files with 120 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/server/authz/classify.ts
View File

@@ -16,30 +16,39 @@ function normalizePathname(rawPath: string): { path: string; reason?: Classifica
if (!path.startsWith("/")) path = "/" + path;
if (path.length > 1 && path.endsWith("/")) path = path.slice(0, -1);
if (path === "/codex" || path.startsWith("/codex/")) {
// Client-API aliases are matched case-insensitively on the control segment.
// Next's rewrite layer accepts `/V1/...`, `/CODEX`, etc. and routes them to
// the client handler, so the classifier must recognize the same casing —
// otherwise an uppercase alias falls through to the management fallback and
// the request is treated as a different route class than it is actually
// dispatched to (GHSA-jvqc-mp9f-q936). Only the leading control segment is
// lowercased for detection; the original-case tail is preserved.
const lower = path.toLowerCase();
if (lower === "/codex" || lower.startsWith("/codex/")) {
return { path: "/api/v1/responses", reason: "client_api_codex_alias" };
}
if (path === "/v1/v1" || path.startsWith("/v1/v1/")) {
if (lower === "/v1/v1" || lower.startsWith("/v1/v1/")) {
const tail = path.slice("/v1/v1".length) || "";
return { path: "/api/v1" + tail, reason: "client_api_double_prefix" };
}
if (path === "/v1beta" || path.startsWith("/v1beta/")) {
if (lower === "/v1beta" || lower.startsWith("/v1beta/")) {
const tail = path.slice("/v1beta".length) || "";
return { path: "/api/v1beta" + tail, reason: "client_api_alias" };
}
if (path === "/v1" || path.startsWith("/v1/")) {
if (lower === "/v1" || lower.startsWith("/v1/")) {
const tail = path.slice("/v1".length) || "";
return { path: "/api/v1" + tail, reason: "client_api_alias" };
}
for (const { alias, canonical } of CLIENT_API_ALIAS_PREFIXES) {
if (path === alias) {
if (lower === alias) {
return { path: canonical, reason: "client_api_alias" };
}
if (path.startsWith(alias + "/")) {
if (lower.startsWith(alias + "/")) {
return { path: canonical + path.slice(alias.length), reason: "client_api_alias" };
}
}