返回提交历史
Modified
g4f/api/__init__.py
+14
-1
XFEstudio/gpt4free
fix(security): restrict CORS wildcard origin reflection with safe defaults and env config
4c531f28
代码差异
1 个文件
+14
-1
@@ -337,10 +337,23 @@ _LOG_SKIP_EXACT = {"/api/logs", "/logs", "/favicon.ico"}
337
337
def create_app():
338
338
app = FastAPI(lifespan=lifespan)
339
339
340
env_origins = [
341
o.strip()
342
for o in os.environ.get("G4F_CORS_ORIGINS", "").split(",")
343
if o.strip()
344
]
345
if env_origins:
346
cors_origins = env_origins
347
cors_regex = None
348
else:
349
cors_origins = []
350
cors_regex = r"^https?://(localhost|127\.0\.0\.1|0\.0\.0\.0)(:[0-9]+)?$"
351
340
352
# Add CORS middleware
341
353
app.add_middleware(
342
354
CORSMiddleware,
343
allow_origins=["*"],
355
allow_origins=cors_origins,
356
allow_origin_regex=cors_regex,
344
357
allow_credentials=True,
345
358
allow_methods=["*"],
346
359
allow_headers=["*"],