wizardchen b2c009e61c feat(security): implement SSRF and path traversal protections in image handling and file downloads ...

- Added SSRF protection by stripping client-supplied URL and Caption fields from image attachments in the QA request handler.
- Introduced a validation function to ensure Feishu API path parameters contain only safe characters, preventing path traversal attacks.
- Enhanced the WeCom webhook adapter to reject internal/private URLs unless they are on an allowlist, improving security during file downloads.
- Implemented a mechanism to bypass SSRF checks for trusted IM platform API hosts.

2026-03-25 22:08:29 +08:00

..

session

feat(security): implement SSRF and path traversal protections in image handling and file downloads

2026-03-25 22:08:29 +08:00

auth.go

fix: improve auth error messages and unify username validation length

2026-03-15 23:59:50 +08:00

chunk.go

feat(api): enhance organization shared knowledge base and agent functionalities

2026-02-09 11:40:25 +08:00

custom_agent.go

feat(agent): enhance agent and skill management features

2026-02-09 11:40:25 +08:00

evaluation.go

feat: 新增API Key认证支持，优化Swagger文档安全配置

2025-12-22 15:01:09 +08:00

faq.go

feat(api): enhance organization shared knowledge base and agent functionalities

2026-02-09 11:40:25 +08:00

im.go

feat(im): add DingTalk platform integration

2026-03-24 22:12:08 +08:00

initialization.go

feat(prompts): update assistant descriptions and add intent-specific templates

2026-03-25 22:08:29 +08:00

knowledge.go

feat: enhance localization and configuration support

2026-03-17 22:23:24 +08:00

knowledgebase.go

feat: enhance knowledge update functionality

2026-03-16 02:26:47 +08:00

mcp_service.go

feat: enhance localization and configuration support

2026-03-17 22:23:24 +08:00

message.go

feat: implement chat history and retrieval settings

2026-03-09 11:46:56 +08:00

model.go

feat: enhance localization and configuration support

2026-03-17 22:23:24 +08:00

organization.go

feat: enhance document loading and state management in doc-content component

2026-03-02 21:21:49 +08:00

skill_handler.go

feat: update sandbox service configuration in Docker Compose files

2026-02-04 21:34:07 +08:00

system.go

feat: enhance localization and configuration support

2026-03-17 22:23:24 +08:00

tag.go

feat: enhance document loading and state management in doc-content component

2026-03-02 21:21:49 +08:00

tenant.go

feat: enhance localization and configuration support

2026-03-17 22:23:24 +08:00

web_search.go

refactor: web search provider registry pattern

2026-01-20 18:19:44 +08:00