zlei6/ragflow
1
0
Fork 0
mirror of https://github.com/infiniflow/ragflow.git synced 2026-08-10 17:31:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

Go: fix SSRF (#17641)

Browse Source 
### Summary

Check the URL to prevent SSRF attack.

---------

Signed-off-by: Jin Hai <haijin.chn@gmail.com>
This commit is contained in:
Jin Hai
2026-07-31 19:15:38 +08:00
committed by GitHub
parent f03a00c54c
commit b058229ab3
146 changed files with 833 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
internal/parser/parser/pdf_parser_somark.go
View File

@@ -84,7 +84,7 @@ func soMarkSubmit(baseURL, filename string, data []byte, parser *PDFParser, apiK
return "", fmt.Errorf("parser: SoMark request: %w", err)
}
req.Header.Set("Content-Type", writer.FormDataContentType())
resp, err := models.NewDriverHTTPClient().Do(req)
resp, err := models.NewDriverHTTPClient(false).Do(req)
if err != nil {
return "", fmt.Errorf("parser: SoMark submit: %w", err)
}
@@ -122,7 +122,7 @@ func soMarkPoll(baseURL, taskID, apiKey string) (map[string]any, error) {
return nil, fmt.Errorf("parser: SoMark poll request: %w", err)
}
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
resp, err := models.NewDriverHTTPClient().Do(req)
resp, err := models.NewDriverHTTPClient(false).Do(req)
if err != nil {
return nil, fmt.Errorf("parser: SoMark poll: %w", err)
}