Files
OmniRoute/open-sse/config/watsonx.ts
diegosouzapw 9e198184a7 fix(security): resolve 14 CodeQL code scanning alerts
- Replace polynomial regex /\/+$/ with loop-based stripTrailingSlashes()
  across 8 enterprise provider configs (azure-openai, azureAi, bedrock,
  datarobot, oci, sap, watsonx, audioSpeech) — fixes js/polynomial-redos

- Add prototype-pollution denylist guard in usageHistory.ts to reject
  __proto__/constructor/prototype as model keys — fixes
  js/prototype-polluting-assignment (#167, #168)

- Suppress 3 false-positive js/insufficient-password-hash alerts in
  chatgpt-web.ts and builtins.ts where SHA-256 is used for cache-key
  derivation, not password storage (#176, #177, #178)

- Add stripTrailingSlashes unit tests with ReDoS regression check
2026-04-27 20:00:10 -03:00

48 lines
1.4 KiB
TypeScript

import { stripTrailingSlashes } from "../utils/urlSanitize.ts";
export const WATSONX_DEFAULT_BASE_URL = "https://ca-tor.ml.cloud.ibm.com/ml/gateway/v1";
function normalizeBaseUrl(value: string | null | undefined): string {
return stripTrailingSlashes((value || "").trim());
}
export function normalizeWatsonxBaseUrl(value: string | null | undefined): string {
const normalized = normalizeBaseUrl(value || WATSONX_DEFAULT_BASE_URL);
if (!normalized) return WATSONX_DEFAULT_BASE_URL;
const stripped = normalized.replace(
/\/(?:chat\/completions|completions|embeddings|models)$/i,
""
);
if (stripped.endsWith("/ml/gateway/v1")) {
return stripped;
}
if (stripped.endsWith("/ml/gateway")) {
return `${stripped}/v1`;
}
try {
const parsed = new URL(stripped);
if (!parsed.pathname || parsed.pathname === "/") {
parsed.pathname = "/ml/gateway/v1";
} else if (parsed.pathname.endsWith("/ml/gateway")) {
parsed.pathname = `${parsed.pathname}/v1`;
}
parsed.search = "";
parsed.hash = "";
return stripTrailingSlashes(parsed.toString());
} catch {
return stripped;
}
}
export function buildWatsonxChatUrl(value: string | null | undefined): string {
return `${normalizeWatsonxBaseUrl(value)}/chat/completions`;
}
export function buildWatsonxModelsUrl(value: string | null | undefined): string {
return `${normalizeWatsonxBaseUrl(value)}/models`;
}