pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-08-25 16:42:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ssrf): honor local-first provider URL flag in outbound guard (#9123)

Browse Source
This commit is contained in:
Markus Hartung
2026-08-21 19:52:54 -03:00
parent 3caa59107e
commit e6648ac960
3 changed files with 61 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/shared/network/outboundUrlGuardPolicy.ts
View File

@@ -56,8 +56,18 @@ export function arePrivateProviderUrlsAllowed() {
return false;
}
/**
* Guard mode for the provider OUTBOUND path (search-provider connection validation, image
* generation, remote image fetch, model discovery — anything that does not go through the
* chat validation path). Precedence — mirrors `getProviderValidationGuard()` (#9123):
* 1. explicit full opt-in (`arePrivateProviderUrlsAllowed`) → "none" (no checks; power users).
* 2. local-first default (`areLocalProviderUrlsAllowed`) → "block-metadata" (allow LAN, block IMDS).
* 3. otherwise → "public-only" (strict).
*/
export function getProviderOutboundGuard(): OutboundUrlGuardMode {
return arePrivateProviderUrlsAllowed() ? "none" : "public-only";
if (arePrivateProviderUrlsAllowed()) return "none";
if (areLocalProviderUrlsAllowed()) return "block-metadata";
return "public-only";
}
/**