Jaymr/new-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ssrf): implement SSRF protection in HTTP clients and validation functions

Browse Source
This commit is contained in:
CaIon
2026-07-06 14:52:01 +08:00
parent 1e11dfcfb5
commit df087b022d
10 changed files with 799 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
service/user_notify.go
+5 -8
View File
@@ -2,7 +2,6 @@ package service
import (
"bytes"
"encoding/json"
"fmt"
"net/http"
"net/url"
@@ -154,8 +153,7 @@ func sendBarkNotify(barkURL string, data dto.Notify) error {
}
} else {
// SSRF防护：验证Bark URL（非Worker模式）
fetchSetting := system_setting.GetFetchSetting()
if err := common.ValidateURLWithFetchSetting(finalURL, fetchSetting.EnableSSRFProtection, fetchSetting.AllowPrivateIp, fetchSetting.DomainFilterMode, fetchSetting.IpFilterMode, fetchSetting.DomainList, fetchSetting.IpList, fetchSetting.AllowedPorts, fetchSetting.ApplyIPFilterForDomain); err != nil {
if err := ValidateSSRFProtectedFetchURL(finalURL); err != nil {
return fmt.Errorf("request reject: %v", err)
}
@@ -169,7 +167,7 @@ func sendBarkNotify(barkURL string, data dto.Notify) error {
req.Header.Set("User-Agent", "OneAPI-Bark-Notify/1.0")
// 发送请求
client := GetHttpClient()
client := GetSSRFProtectedHTTPClient()
resp, err = client.Do(req)
if err != nil {
return fmt.Errorf("failed to send bark request: %v", err)
@@ -215,7 +213,7 @@ func sendGotifyNotify(gotifyUrl string, gotifyToken string, priority int, data d
}
// 序列化为 JSON
payloadBytes, err := json.Marshal(payload)
payloadBytes, err := common.Marshal(payload)
if err != nil {
return fmt.Errorf("failed to marshal gotify payload: %v", err)
}
@@ -248,8 +246,7 @@ func sendGotifyNotify(gotifyUrl string, gotifyToken string, priority int, data d
}
} else {
// SSRF防护：验证Gotify URL（非Worker模式）
fetchSetting := system_setting.GetFetchSetting()
if err := common.ValidateURLWithFetchSetting(finalURL, fetchSetting.EnableSSRFProtection, fetchSetting.AllowPrivateIp, fetchSetting.DomainFilterMode, fetchSetting.IpFilterMode, fetchSetting.DomainList, fetchSetting.IpList, fetchSetting.AllowedPorts, fetchSetting.ApplyIPFilterForDomain); err != nil {
if err := ValidateSSRFProtectedFetchURL(finalURL); err != nil {
return fmt.Errorf("request reject: %v", err)
}
@@ -264,7 +261,7 @@ func sendGotifyNotify(gotifyUrl string, gotifyToken string, priority int, data d
req.Header.Set("User-Agent", "NewAPI-Gotify-Notify/1.0")
// 发送请求
client := GetHttpClient()
client := GetSSRFProtectedHTTPClient()
resp, err = client.Do(req)
if err != nil {
return fmt.Errorf("failed to send gotify request: %v", err)