mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-21 22:52:19 +03:00
a2d5ef50f4
Next compiles the proxy matcher from `regexp.source` only, dropping path-to-regexp's case-insensitive flag, so `/v1/:path*` never matched `/V1/...` while the rewrite layer (flag kept) still routed it to the handler — an unauthenticated inference bypass via uppercase / mixed-case paths (/V1, /V1BETA, /CHAT, /RESPONSES, /CODEX, /MODELS). Expressing the casing inside a path-to-regexp custom group (`([vV]1)`) survives the flag-drop. classify.ts normalizes the control segment case so uppercase aliases resolve to CLIENT_API (honoring REQUIRE_API_KEY) instead of the management fallback. Reported by @Evgeny-SPB via GHSA-jvqc-mp9f-q936.