scriptoriumadmin/Roo-Code
1
0
Fork 0
mirror of https://github.com/RooVetGit/Roo-Code.git synced 2026-09-07 08:26:51 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: use proper URL host validation for .volces.com (CodeQL security fix)

Browse source 
Replace substring check with proper URL host parsing to prevent
incomplete URL substring sanitization. The previous check using
modelUrl.includes(".volces.com") could be bypassed by placing
the string anywhere in the URL (path, query string, etc.).

Now using _getUrlHost() to properly parse the URL and validate
that the host either equals "volces.com" or ends with ".volces.com",
consistent with how Azure is already validated in the codebase.
This commit is contained in:
Roo Code 2026-01-10 21:53:49 +00:00
parent 12ee8e9e55
commit d8c0661483
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/api/providers/openai.ts
View file

@ -92,7 +92,8 @@ export class OpenAiHandler extends BaseProvider implements SingleCompletionHandl
const enabledLegacyFormat = this.options.openAiLegacyFormat ?? false
const isAzureAiInference = this._isAzureAiInference(modelUrl)
const deepseekReasoner = modelId.includes("deepseek-reasoner") || enabledR1Format
const ark = modelUrl.includes(".volces.com")
const modelUrlHost = this._getUrlHost(modelUrl)
const ark = modelUrlHost === "volces.com" || modelUrlHost.endsWith(".volces.com")
if (modelId.includes("o1") || modelId.includes("o3") || modelId.includes("o4")) {
yield* this.handleO3FamilyMessage(modelId, systemPrompt, messages, metadata)