gpt4free

公开

关注 0 Fork 0 Star 1

XFEstudio/gpt4free

Use request.url.netloc (ASGI scope) instead of Host header for CSP origin

Agent-Logs-Url: https://github.com/xtekky/gpt4free/sessions/d964c73c-85bc-432d-b14b-20f8ea2de94e Co-authored-by: hlohaus <983577+hlohaus@users.noreply.github.com>

f79edb39

copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

提交于 2026-04-04 19:39

父提交 dafc1d9

代码差异

2 个文件 +11 -8

Modified etc/unittest/mcp.py +5 -2

@@ -777,9 +777,12 @@ class TestWorkspaceFileServing(unittest.TestCase):

777 777 import g4f.api as api_mod

778 778 import inspect

779 779 src = inspect.getsource(api_mod.Api.register_routes)

780 # The route must derive the origin from the incoming Request object.

780 # The route must derive the origin from the ASGI scope, not the

781 # client-controlled Host header.

781 782 self.assertIn("request_origin", src,

782 783 "CSP must use the actual request origin, not static 'self'")

783 784 self.assertIn("request.url.scheme", src,

784 "Route must extract scheme from the Request for the origin")

785 "Route must extract scheme from request.url (ASGI scope)")

786 self.assertIn("request.url.netloc", src,

787 "Route must extract netloc from request.url (ASGI scope), not Host header")

785 788

Modified g4f/api/__init__.py +6 -6

@@ -937,12 +937,12 @@ class Api:

937 937 HTTP_403_FORBIDDEN,

938 938 )

939 939

940 # Derive the actual request origin (scheme + host) so that CSP

941 # source directives reference the real server address rather than

942 # the generic 'self' keyword. This is important because HTML

943 # files are sandboxed into a null origin (see below), at which

944 # point 'self' would resolve to null and block all sub-resources.

945 request_origin = f"{request.url.scheme}://{request.headers.get('host', 'localhost')}"

940 # Derive the actual request origin (scheme + authority) from the

941 # ASGI scope via request.url — this is set by the server

942 # infrastructure and is not controllable by the client (unlike the

943 # Host header, which can be spoofed to inject arbitrary values into

944 # the CSP). request.url.netloc includes the port when non-default.

945 request_origin = f"{request.url.scheme}://{request.url.netloc}"

946 946

947 947 is_html = ext in ("html", "htm")

948 948 if is_html: