opensource
/
dify
mirror of https://github.com/langgenius/dify.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/customer-tool-SSRF' of github.com:langgenius/dify into fix/customer-tool-SSRF

This commit is contained in:
Yansong Zhang 2025-12-12 17:11:00 +08:00
parent 309875650d fc260fab97
commit 790ed0845e
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
api/core/helper/ssrf_proxy.py
View File

@ -99,7 +99,7 @@ def make_request(method, url, max_retries=SSRF_DEFAULT_MAX_RETRIES, **kwargs):
# Check if this is a Squid SSRF rejection
server_header = response.headers.get("server", "").lower()
via_header = response.headers.get("via", "").lower()
# Squid typically identifies itself in Server or Via headers
if "squid" in server_header or "squid" in via_header:
raise ToolSSRFError(

6
api/tests/unit_tests/core/helper/test_ssrf_proxy.py
View File

@ -63,7 +63,7 @@ def test_squid_ssrf_rejection_detected(mock_request):
with pytest.raises(ToolSSRFError) as exc_info:
make_request("GET", "http://192.168.1.1/api")
assert "blocked by SSRF protection" in str(exc_info.value)
assert "192.168.1.1" in str(exc_info.value)
assert "squid.conf.template" in str(exc_info.value)
@ -79,7 +79,7 @@ def test_squid_ssrf_rejection_via_header(mock_request):
with pytest.raises(ToolSSRFError) as exc_info:
make_request("GET", "http://10.0.0.1/api")
assert "SSRF protection" in str(exc_info.value)
@ -93,7 +93,7 @@ def test_squid_401_rejection_detected(mock_request):
with pytest.raises(ToolSSRFError) as exc_info:
make_request("GET", "http://192.168.1.1/api")
assert "SSRF protection" in str(exc_info.value)
assert "squid.conf.template" in str(exc_info.value)