fit2cloud-chenywandClaude bbfc4cc8f5 fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD) ...

- TokenMiddleware/ResponseMiddleware/audit logger use scope['path']
  instead of request.url.path for whitelist checks: a crafted Host
  header (e.g. x/api/v1/mcp) was concatenated into Starlette's URL
  and made protected routes match the /mcp* whitelist entry
- validateEmbedded rejects admin accounts and non-type-4 apps, so a
  self-signed token with account=admin can no longer impersonate the
  administrator
- Add HostValidationMiddleware rejecting malformed Host headers at the
  outermost layer (defense in depth)
- Add regression tests for host validation, whitelist matching and
  source-level guards

Co-Authored-By: Claude <[email protected]>

2026-08-31 11:05:05 +08:00

..

ai_model

chron: format line

2026-06-22 14:30:29 +08:00

chat

feat: MCP support model

2026-08-19 10:20:40 +08:00

dashboard

fix(dashboard): Fix the issue where the predicted data cannot be displayed on the data dashboard

2026-04-27 10:53:14 +08:00

data_training

fix: Prevent Authorization Bypass Through User-Controlled Key problem (CWE-639)

2026-08-28 18:22:35 +08:00

datasource

feat: system param support key-value #1310

2026-08-10 14:09:02 +08:00

db

fix: Kingbase SQL inject

2026-08-27 15:04:39 +08:00

mcp

feat: MCP support model

2026-08-18 17:02:43 +08:00

settings

feat: Add Api Docs

2025-12-15 16:30:07 +08:00

swagger

feat(Model Configuration): Supported Authorized Space

2026-06-04 14:38:00 +08:00

system

fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD)

2026-08-31 11:05:05 +08:00

template

feat: improve generate sql template

2025-10-15 18:34:47 +08:00

terminology

fix: Prevent Authorization Bypass Through User-Controlled Key problem (CWE-639)

2026-08-28 18:22:35 +08:00

__init__.py

feat: Login api

2025-04-23 21:14:42 +08:00

api.py

feat: support system variable

2026-02-05 10:15:46 +08:00