klinsmaya/SQLBot
1
0
Fork 0
mirror of https://gh-proxy.org/https://github.com/klinsmaya/SQLBot.git synced 2026-11-08 01:06:59 +08:00
Code Issues Packages Projects Releases Wiki Activity
2,490 Commits 1 Branch 0 Tags
main
Commit Graph
29 Commits
Author SHA1 Message Date
fit2cloud-chenywandClaude bbfc4cc8f5 fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD) 
- TokenMiddleware/ResponseMiddleware/audit logger use scope['path']
  instead of request.url.path for whitelist checks: a crafted Host
  header (e.g. x/api/v1/mcp) was concatenated into Starlette's URL
  and made protected routes match the /mcp* whitelist entry
- validateEmbedded rejects admin accounts and non-type-4 apps, so a
  self-signed token with account=admin can no longer impersonate the
  administrator
- Add HostValidationMiddleware rejecting malformed Host headers at the
  outermost layer (defense in depth)
- Add regression tests for host validation, whitelist matching and
  source-level guards

Co-Authored-By: Claude <[email protected]>
 2026-08-31 11:05:05 +08:00
fit2cloud-chenyw a70eb1b308 fix: Embedded security vulnerabilities 2026-07-14 15:31:42 +08:00
fit2cloud-chenyw bca72fc96d perf: Assistant uses workspace-level Q&A configuration 2026-01-28 14:15:46 +08:00
xuwei-fit2cloud c6909c5e28 refactor: Code security optimization 2025-12-26 16:38:47 +08:00
fit2cloud-chenyw a6dcec08ab perf: Optimize API permission validation 2025-12-24 15:27:51 +08:00
fit2cloud-chenyw 1190bc3954 perf: Optimizing API Key Authentication 2025-12-23 16:18:57 +08:00
fit2cloud-chenyw 8a143ed21e fix: Page Embedding Authentication Vulnerability 2025-12-18 16:02:08 +08:00
fit2cloud-chenyw d2556a4231 fix: Assistant asks about the process of mathematical thinking internationalization error 2025-12-18 14:53:38 +08:00
fit2cloud-chenyw 0e418d2ee8 perf: Optimize embedded compatibility for multi-domain verification 2025-11-26 13:29:26 +08:00
fit2cloud-chenyw c7693fc880 perf: Multiple Domain Validation for Embedded Systems #388 2025-11-25 21:43:21 +08:00
fit2cloud-chenyw e12107646f perf: Formatting of Assistant Workspace ID 2025-09-03 18:15:10 +08:00
fit2cloud-chenyw 3139b62d76 perf: Assistant's basic application records are stored in the workspace of their respective data source 2025-09-03 17:53:15 +08:00
fit2cloud-chenyw cf61ff027d perf: Embed Parameter Optimization 2025-09-01 18:46:45 +08:00
fit2cloud-chenyw 5323993214 perf: Optimize page embedding mechanism 2025-08-21 10:00:50 +08:00
fit2cloud-chenyw 1d633e1cfe perf: Token expired message 2025-08-06 16:41:18 +08:00
fit2cloud-chenyw c54f8640d7 perf: Authenticate invalid msg 2025-07-30 17:28:32 +08:00
fit2cloud-chenyw 8e01bf6484 perf: Exception msg 2025-07-28 10:08:15 +08:00
fit2cloud-chenyw 2b1432249a perf: Check user status 2025-07-25 18:08:32 +08:00
fit2cloud-chenyw cc87040c25 perf: User cache log 2025-07-24 12:42:19 +08:00
fit2cloud-chenyw 2dbc9b4590 perf: Enable user cache 2025-07-23 17:49:37 +08:00
fit2cloud-chenyw 63a1d1fe7d feat: Log file 2025-07-23 15:59:23 +08:00
fit2cloud-chenyw 8c00b44777 perf: dev error msg 2025-07-23 12:41:14 +08:00
fit2cloud-chenyw 36d52dfa67 perf: Assistant dynamic certificate 2025-07-22 12:20:51 +08:00
fit2cloud-chenyw 42cacffa9f perf: Token 2025-07-17 09:29:39 +08:00
fit2cloud-chenyw e9a893a330 perf: Token 2025-07-17 09:19:41 +08:00
fit2cloud-chenyw 070f556af0 perf: Assistant 2025-07-16 11:29:48 +08:00
fit2cloud-chenyw bb5c04674e perf: Assistant chat history 2025-07-14 16:13:39 +08:00
fit2cloud-chenyw e69caadd09 perf: Assistant token 2025-07-10 12:43:14 +08:00
fit2cloud-chenyw b009779c0e feat: Token middleware 2025-04-28 15:00:37 +08:00