wizardchen b2c009e61c feat(security): implement SSRF and path traversal protections in image handling and file downloads ...

- Added SSRF protection by stripping client-supplied URL and Caption fields from image attachments in the QA request handler.
- Introduced a validation function to ensure Feishu API path parameters contain only safe characters, preventing path traversal attacks.
- Enhanced the WeCom webhook adapter to reject internal/private URLs unless they are on an allowlist, improving security during file downloads.
- Implemented a mechanism to bypass SSRF checks for trusted IM platform API hosts.

2026-03-25 22:08:29 +08:00

..

dingtalk

feat(im): add AI card streaming for DingTalk and improve IM platform robustness

2026-03-24 22:12:08 +08:00

feishu

feat(security): implement SSRF and path traversal protections in image handling and file downloads

2026-03-25 22:08:29 +08:00

slack

feat(IM): support both websocket/webhook mode im channel for slack

2026-03-18 21:26:53 +08:00

telegram

feat(im): add AI card streaming for DingTalk and improve IM platform robustness

2026-03-24 22:12:08 +08:00

wecom

feat(security): implement SSRF and path traversal protections in image handling and file downloads

2026-03-25 22:08:29 +08:00

adapter.go

feat(im): add DingTalk platform integration

2026-03-24 22:12:08 +08:00

cmd_clear.go

feat(im): add slash-command system with /help, /info, /search, /stop, /clear

2026-03-20 15:49:59 +08:00

cmd_help.go

feat(im): add slash-command system with /help, /info, /search, /stop, /clear

2026-03-20 15:49:59 +08:00

cmd_info.go

feat(im): add slash-command system with /help, /info, /search, /stop, /clear

2026-03-20 15:49:59 +08:00

cmd_search.go

feat(im): add slash-command system with /help, /info, /search, /stop, /clear

2026-03-20 15:49:59 +08:00

cmd_stop.go

feat(im): add slash-command system with /help, /info, /search, /stop, /clear

2026-03-20 15:49:59 +08:00

command_registry.go

feat(im): add slash-command system with /help, /info, /search, /stop, /clear

2026-03-20 15:49:59 +08:00

command.go

feat(im): add slash-command system with /help, /info, /search, /stop, /clear

2026-03-20 15:49:59 +08:00

qaqueue.go

feat(im): add multi-instance support with Redis-based distributed coordination

2026-03-20 15:49:59 +08:00

ratelimit.go

feat(im): add multi-instance support with Redis-based distributed coordination

2026-03-20 15:49:59 +08:00

service.go

feat(agent): enhance token management and context handling in AgentEngine

2026-03-25 22:08:29 +08:00

stream_test.go

feat: enhance IM integration with streaming support and documentation

2026-03-16 02:26:17 +08:00

think.go

feat(im): add AI card streaming for DingTalk and improve IM platform robustness

2026-03-24 22:12:08 +08:00

types.go

feat(agent): enhance token management and context handling in AgentEngine

2026-03-25 22:08:29 +08:00