mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-05 06:42:12 +03:00
0e07eb0518
qwen-web had no specialty validator, so validation fell through to the generic OpenAI-compatible path which probed a bogus /api/v2/models URL. That answers with a 307 redirect, the outbound guard blocked it, and the route surfaced it as provider.validation.ssrf_blocked. - Add a qwen-web specialty validator that probes the real session endpoint (GET /api/v2/user, like Chat2API) with the executor's anti-bot headers + cookie-jar replay, bypassing the addModelsSuffix path. - Harden toValidationErrorResult: a blocked redirect is only a security block when its target is a private/internal host; a benign 3xx to a public host is no longer mislabeled as SSRF (affected all web-cookie providers). Refs #3288 #3758