mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-24 08:02:14 +03:00
81cc000cf5
/v1/search accepted provider_options.baseUrl / providerSpecificData.baseUrl verbatim and flowed it through resolveSearchBaseUrl() into every builder's server-side fetch target, while the sink (searchProxy.ts) is a plain fetch(). The Firecrawl sibling was fixed in #10738; this shared resolver was missed — full-read SSRF to cloud metadata (IMDS credential theft) and JSON-speaking internal services, reachable with no credentials on the default posture. resolveSearchBaseUrl() now validates any request-supplied override with parseAndValidateNonMetadataUrl (block-metadata): self-hosted searxng on loopback/LAN — the provider's primary use case — keeps working, while cloud-metadata endpoints are rejected. The catalog's operator-configured baseUrl stays untouched.