返回提交历史
Modified
g4f/api/__init__.py
+5
-2
XFEstudio/gpt4free
fix(security): prevent SSRF by validating remote URLs and private IP ranges in media endpoints
4af8d0c1
代码差异
1 个文件
+5
-2
@@ -36,6 +36,7 @@ from starlette.status import (
36
36
HTTP_403_FORBIDDEN,
37
37
HTTP_429_TOO_MANY_REQUESTS,
38
38
HTTP_500_INTERNAL_SERVER_ERROR,
39
HTTP_502_BAD_GATEWAY,
39
40
)
40
41
41
42
try:
@@ -85,7 +86,7 @@ from g4f.client import AsyncClient, ChatCompletion, ImagesResponse
85
86
from g4f.providers.response import BaseConversation, JsonConversation
86
87
from g4f.client.helper import filter_none
87
88
from g4f.config import DEFAULT_PORT, DEFAULT_TIMEOUT, DEFAULT_STREAM_TIMEOUT
88
from g4f.image import EXTENSIONS_MAP, is_data_an_media, process_image
89
from g4f.image import EXTENSIONS_MAP, is_data_an_media, process_image, is_safe_url
89
90
from g4f.image.copy_images import get_media_dir, copy_media, get_source_url
90
91
from g4f.errors import (
91
92
ProviderNotFoundError,
@@ -2204,13 +2205,15 @@ class Api:
2204
2205
source_url = f"{backend_url}/media/{filename}"
2205
2206
ssl = False
2206
2207
if source_url is not None:
2208
if not is_safe_url(source_url):
2209
return ErrorResponse.from_message("Invalid or unsafe source URL", HTTP_400_BAD_REQUEST)
2207
2210
try:
2208
2211
await copy_media([source_url], target=target, ssl=ssl)
2209
2212
debug.log(f"File copied from {source_url}")
2210
2213
except Exception as e:
2211
2214
debug.error(f"Download failed: {source_url}")
2212
2215
debug.error(e)
2213
return RedirectResponse(url=source_url)
2216
return ErrorResponse.from_message("Failed to fetch remote media", HTTP_502_BAD_GATEWAY)
2214
2217
if thumbnail and has_pillow:
2215
2218
try:
2216
2219
if not os.path.isfile(thumbnail):