opensource/sub2api
3
0
Fork 0
mirror of https://github.com/Wei-Shaw/sub2api.git synced 2026-09-21 22:31:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4299 from wp-a/fix/xai-oauth-unsafe-base-url-components

Browse Source 
fix(xai): reject empty base URL queries
This commit is contained in:
Wesley Liddick
2026-07-15 14:21:42 +08:00
committed by GitHub
parent e4a0e69424 e8e360c802
commit 83ef20bf8b
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/pkg/xai/oauth.go
+1 -1
View File
@@ -306,7 +306,7 @@ func normalizeKnownBaseURLPath(raw string) (string, error) {
if parsed.User != nil {
return "", errors.New("base URL must not include userinfo")
}
if parsed.RawQuery != "" {
if parsed.ForceQuery || parsed.RawQuery != "" {
return "", errors.New("base URL must not include a query")
}
if parsed.Fragment != "" {
backend/internal/pkg/xai/oauth_test.go
+9
View File
@@ -166,6 +166,14 @@ func TestValidateBaseURLAllowsPublicThirdPartyGrokAPI(t *testing.T) {
require.Error(t, err)
}
func TestValidateBaseURLsRejectEmptyQueryDelimiter(t *testing.T) {
_, err := ValidateBaseURL("https://grok.example.test/v1?")
require.Error(t, err)
_, err = ValidateTrustedBaseURL("https://api.x.ai/v1?")
require.Error(t, err)
}
func TestBuildResponsesURLWithValidatorUsesCallerPolicy(t *testing.T) {
validator := func(raw string) (string, error) {
return urlvalidator.ValidateURLFormat(raw, true)
@@ -192,6 +200,7 @@ func TestBuildResponsesURLWithValidatorRejectsBaseURLComponents(t *testing.T) {
}{
{name: "userinfo", raw: "https://user:secret@grok.example.test/v1"},
{name: "query", raw: "https://grok.example.test/v1?token=secret"},
{name: "empty query delimiter", raw: "https://grok.example.test/v1?"},
{name: "fragment", raw: "https://grok.example.test/v1#secret"},
}