opensource/dify
2
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-04-28 11:56:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/customer-tool-SSRF' of github.com:langgenius/dify into fix/customer-tool-SSRF

Browse Source
This commit is contained in:
Yansong Zhang 2025-12-12 17:11:00 +08:00
commit 790ed0845e
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
api/core/helper/ssrf_proxy.py
View File

@ -99,7 +99,7 @@ def make_request(method, url, max_retries=SSRF_DEFAULT_MAX_RETRIES, **kwargs):
# Check if this is a Squid SSRF rejection # Check if this is a Squid SSRF rejection
server_header = response.headers.get("server", "").lower() server_header = response.headers.get("server", "").lower()
via_header = response.headers.get("via", "").lower() via_header = response.headers.get("via", "").lower()
# Squid typically identifies itself in Server or Via headers # Squid typically identifies itself in Server or Via headers
if "squid" in server_header or "squid" in via_header: if "squid" in server_header or "squid" in via_header:
raise ToolSSRFError( raise ToolSSRFError(

6
api/tests/unit_tests/core/helper/test_ssrf_proxy.py
View File

@ -63,7 +63,7 @@ def test_squid_ssrf_rejection_detected(mock_request):
with pytest.raises(ToolSSRFError) as exc_info: with pytest.raises(ToolSSRFError) as exc_info:
make_request("GET", "http://192.168.1.1/api") make_request("GET", "http://192.168.1.1/api")
assert "blocked by SSRF protection" in str(exc_info.value) assert "blocked by SSRF protection" in str(exc_info.value)
assert "192.168.1.1" in str(exc_info.value) assert "192.168.1.1" in str(exc_info.value)
assert "squid.conf.template" in str(exc_info.value) assert "squid.conf.template" in str(exc_info.value)
@ -79,7 +79,7 @@ def test_squid_ssrf_rejection_via_header(mock_request):
with pytest.raises(ToolSSRFError) as exc_info: with pytest.raises(ToolSSRFError) as exc_info:
make_request("GET", "http://10.0.0.1/api") make_request("GET", "http://10.0.0.1/api")
assert "SSRF protection" in str(exc_info.value) assert "SSRF protection" in str(exc_info.value)
@ -93,7 +93,7 @@ def test_squid_401_rejection_detected(mock_request):
with pytest.raises(ToolSSRFError) as exc_info: with pytest.raises(ToolSSRFError) as exc_info:
make_request("GET", "http://192.168.1.1/api") make_request("GET", "http://192.168.1.1/api")
assert "SSRF protection" in str(exc_info.value) assert "SSRF protection" in str(exc_info.value)
assert "squid.conf.template" in str(exc_info.value) assert "squid.conf.template" in str(exc_info.value)