fit2cloud-chenywandClaude bbfc4cc8f5 fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD) ...

- TokenMiddleware/ResponseMiddleware/audit logger use scope['path']
  instead of request.url.path for whitelist checks: a crafted Host
  header (e.g. x/api/v1/mcp) was concatenated into Starlette's URL
  and made protected routes match the /mcp* whitelist entry
- validateEmbedded rejects admin accounts and non-type-4 apps, so a
  self-signed token with account=admin can no longer impersonate the
  administrator
- Add HostValidationMiddleware rejecting malformed Host headers at the
  outermost layer (defense in depth)
- Add regression tests for host validation, whitelist matching and
  source-level guards

Co-Authored-By: Claude <[email protected]>

2026-08-31 11:05:05 +08:00

..

api

fix: Cross-Workspace Assistant Modification and Deletion (IDOR)

2026-08-28 15:37:45 +08:00

crud

fix: Cross-Workspace Assistant Modification and Deletion (IDOR)

2026-08-28 15:37:45 +08:00

middleware

fix(Security): Host header injection auth bypass and forged admin embedded token (CNVD)

2026-08-31 11:05:05 +08:00

models

feat(Application): Application can configure specified model

2026-06-02 16:24:44 +08:00

schemas

fix: Compatible with older versions of MSSQL in DataEase

2026-06-23 14:57:10 +08:00

__init__.py

feat: Login api

2025-04-23 21:14:42 +08:00