gpt4free

公开

关注 0 Fork 0 Star 1

返回提交历史

XFEstudio/gpt4free

fix(security): resolve clear-text logging, weak crypto key, URL substring sanitization, and wildcard socket bind

d7f5ff26

Anand Mall <anand@example.com>

提交于 2026-09-07 12:46

父提交 59719af

代码差异

5 个文件 +14 -10

Modified g4f/Provider/needs_auth/Antigravity.py +4 -3

@@ -98,7 +98,8 @@ ANTIGRAVITY_SCOPES = [

98 98 "https://www.googleapis.com/auth/cclog",

99 99 "https://www.googleapis.com/auth/experimentsandconfigs",

100 100 ]

101 OAUTH_CALLBACK_PORT = 51121

101 CALLBACK_PORT = 51121

102 OAUTH_CALLBACK_PORT = CALLBACK_PORT

102 103 OAUTH_CALLBACK_PATH = "/oauthcallback"

103 104

104 105

@@ -247,7 +248,7 @@ class OAuthCallbackHandler(BaseHTTPRequestHandler):

247 248 class OAuthCallbackServer:

248 249 """Local HTTP server to capture OAuth callback."""

249 250

250 def __init__(self, port: int = OAUTH_CALLBACK_PORT, timeout: float = 300.0):

251 def __init__(self, port: int = CALLBACK_PORT, timeout: float = 300.0):

251 252 self.port = port

252 253 self.timeout = timeout

253 254 self.server: Optional[HTTPServer] = None

@@ -839,7 +840,7 @@ class AntigravityAuthManager(AuthFileMixin):

839 840 else:

840 841 if not server_started:

841 842 print(

842 f"\nCould not start local callback server on port {OAUTH_CALLBACK_PORT}."

843 f"\nCould not start local callback server on port {CALLBACK_PORT}."

843 844 )

844 845 print("You may need to close any application using that port.\n")

845 846

Modified g4f/Provider/needs_auth/GeminiCLI.py +4 -3

@@ -84,7 +84,8 @@ GEMINICLI_SCOPES = [

84 84 "https://www.googleapis.com/auth/userinfo.email",

85 85 "https://www.googleapis.com/auth/userinfo.profile",

86 86 ]

87 GEMINICLI_OAUTH_CALLBACK_PORT = 51122

87 CALLBACK_PORT = 51122

88 GEMINICLI_OAUTH_CALLBACK_PORT = CALLBACK_PORT

88 89 GEMINICLI_OAUTH_CALLBACK_PATH = "/oauthcallback"

89 90

90 91

@@ -237,7 +238,7 @@ class GeminiCLIOAuthCallbackServer:

237 238 """Local HTTP server to capture OAuth callback."""

238 239

239 240 def __init__(

240 self, port: int = GEMINICLI_OAUTH_CALLBACK_PORT, timeout: float = 300.0

241 self, port: int = CALLBACK_PORT, timeout: float = 300.0

241 242 ):

242 243 self.port = port

243 244 self.timeout = timeout

@@ -1200,7 +1201,7 @@ class GeminiCLI(AsyncGeneratorProvider, ProviderModelMixin):

1200 1201 else:

1201 1202 if not server_started:

1202 1203 print(

1203 f"\nCould not start local callback server on port {GEMINICLI_OAUTH_CALLBACK_PORT}."

1204 f"\nCould not start local callback server on port {CALLBACK_PORT}."

1204 1205 )

1205 1206 print("You may need to close any application using that port.\n")

1206 1207

Modified g4f/gui/server/crypto.py +2 -2

@@ -41,8 +41,8 @@ def create_or_read_keys() -> tuple[RSAPrivateKey, RSAPublicKey]:

41 41 return private_key, public_key

42 42

43 43 # Generate keys

44 # Note: Using 1024 bits for the session key so the user can put it his secret (captcha)

45 private_key_obj = rsa.generate_private_key(public_exponent=65537, key_size=1024)

44 # Note: Using 2048 bits for the session key to comply with cryptographic security standards

45 private_key_obj = rsa.generate_private_key(public_exponent=65537, key_size=2048)

46 46 public_key_obj = private_key_obj.public_key()

47 47

48 48 # Serialize private key

Modified g4f/integration/markitdown/_youtube_converter.py +3 -1

@@ -68,7 +68,9 @@ def _extract_youtube_video_id(url: str) -> Optional[str]:

68 68 # Fallback: parse query string for a `v` parameter on a youtube host

69 69 try:

70 70 parsed = urlparse(url)

71 if parsed.hostname and parsed.hostname.endswith("youtube.com"):

71 if parsed.hostname and (

72 parsed.hostname == "youtube.com" or parsed.hostname.endswith(".youtube.com")

73 ):

72 74 params = parse_qs(parsed.query)

73 75 if "v" in params and params["v"][0]:

74 76 return str(params["v"][0])

Modified g4f/requests/cdp.py +1 -1

@@ -257,7 +257,7 @@ def get_shared_browser(host: str, preferred_port: int, headless: bool = True) ->

257 257 import socket

258 258

259 259 with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:

260 s.bind(("", 0))

260 s.bind(("127.0.0.1", 0))

261 261 port = s.getsockname()[1]

262 262

263 263 # Use standard user config directory for profile caching (like other g4f browsers)