Files
OmniRoute/tests/unit
Xiangzhe a2d5ef50f4 fix(security): match client-API aliases case-insensitively in the authz matcher
Next compiles the proxy matcher from `regexp.source` only, dropping
path-to-regexp's case-insensitive flag, so `/v1/:path*` never matched `/V1/...`
while the rewrite layer (flag kept) still routed it to the handler — an
unauthenticated inference bypass via uppercase / mixed-case paths (/V1, /V1BETA,
/CHAT, /RESPONSES, /CODEX, /MODELS). Expressing the casing inside a
path-to-regexp custom group (`([vV]1)`) survives the flag-drop. classify.ts
normalizes the control segment case so uppercase aliases resolve to CLIENT_API
(honoring REQUIRE_API_KEY) instead of the management fallback.

Reported by @Evgeny-SPB via GHSA-jvqc-mp9f-q936.
2026-08-21 13:14:53 -03:00
..
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00
2026-07-29 15:18:55 -03:00