From d8c0661483fb93cb7b2c24cb917175ce52a154b2 Mon Sep 17 00:00:00 2001 From: Roo Code Date: Sat, 10 Jan 2026 21:53:49 +0000 Subject: [PATCH] fix: use proper URL host validation for .volces.com (CodeQL security fix) Replace substring check with proper URL host parsing to prevent incomplete URL substring sanitization. The previous check using modelUrl.includes(".volces.com") could be bypassed by placing the string anywhere in the URL (path, query string, etc.). Now using _getUrlHost() to properly parse the URL and validate that the host either equals "volces.com" or ends with ".volces.com", consistent with how Azure is already validated in the codebase. --- src/api/providers/openai.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/api/providers/openai.ts b/src/api/providers/openai.ts index 2a2065edd6..2d6b5b32d1 100644 --- a/src/api/providers/openai.ts +++ b/src/api/providers/openai.ts @@ -92,7 +92,8 @@ export class OpenAiHandler extends BaseProvider implements SingleCompletionHandl const enabledLegacyFormat = this.options.openAiLegacyFormat ?? false const isAzureAiInference = this._isAzureAiInference(modelUrl) const deepseekReasoner = modelId.includes("deepseek-reasoner") || enabledR1Format - const ark = modelUrl.includes(".volces.com") + const modelUrlHost = this._getUrlHost(modelUrl) + const ark = modelUrlHost === "volces.com" || modelUrlHost.endsWith(".volces.com") if (modelId.includes("o1") || modelId.includes("o3") || modelId.includes("o4")) { yield* this.handleO3FamilyMessage(modelId, systemPrompt, messages, metadata)