返回提交历史
Modified
g4f/gui/server/backend_api.py
+12
-8
XFEstudio/gpt4free
fix(security): resolve reflective XSS and open URL redirection in backend_api
28b89013
代码差异
1 个文件
+12
-8
@@ -766,11 +766,18 @@ class Backend_Api(Api):
766
766
finally:
767
767
os.remove(os.path.join(media_dir, filename))
768
768
else:
769
return redirect(response)
769
if response.startswith("/") and not response.startswith("//"):
770
return redirect(response)
771
return Response(response, mimetype="text/plain")
770
772
elif response.startswith("https://") or response.startswith(
771
773
"http://"
772
774
):
773
return redirect(response)
775
from urllib.parse import urlparse
776
target_netloc = urlparse(response).netloc.lower()
777
allowed_hosts = {request.host.lower()}
778
if target_netloc in allowed_hosts:
779
return redirect(response)
780
return Response(response, mimetype="text/plain")
774
781
if do_filter:
775
782
is_true_filter = do_filter.lower() in ["true", "1"]
776
783
response = (
@@ -923,7 +930,7 @@ class Backend_Api(Api):
923
930
) as f:
924
931
for filename in filenames:
925
932
f.write(f"{filename}\n")
926
return {"bucket_id": bucket_id, "files": filenames, "media": media}
933
return jsonify({"bucket_id": bucket_id, "files": filenames, "media": media})
927
934
928
935
@app.route("/files/<bucket_id>/<file_type>/<filename>", methods=["GET"])
929
936
def get_media(bucket_id, file_type: str, filename, dirname: str = None):
@@ -939,9 +946,6 @@ class Backend_Api(Api):
939
946
try:
940
947
return send_from_directory(os.path.abspath(media_dir), filename)
941
948
except NotFound:
942
source_url = get_source_url(request.query_string.decode())
943
if source_url is not None:
944
return redirect(source_url)
945
949
raise
946
950
947
951
self.match_files = {}
@@ -1042,7 +1046,7 @@ class Backend_Api(Api):
1042
1046
share_id = secure_filename(share_id)
1043
1047
cache_value = self.chat_cache.get(share_id, 0)
1044
1048
if updated == cache_value:
1045
return {"share_id": share_id}
1049
return jsonify({"share_id": share_id})
1046
1050
bucket_dir = get_bucket_dir(share_id)
1047
1051
os.makedirs(bucket_dir, exist_ok=True)
1048
1052
with open(
@@ -1050,7 +1054,7 @@ class Backend_Api(Api):
1050
1054
) as f:
1051
1055
json.dump(chat_data, f)
1052
1056
self.chat_cache[share_id] = updated
1053
return {"share_id": share_id}
1057
return jsonify({"share_id": share_id})
1054
1058
1055
1059
def handle_synthesize(self, provider: str):
1056
1060
try: