root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: re-throw ApiError in SSRF catch block so private-IP guards actually work

Browse Source 
The bare catch {} swallowed the ApiError thrown by the private-IP
checks, defeating the entire DNS-based SSRF protection. Now catches
and re-throws ApiError so security rejections propagate correctly;
only DNS-lookup failures fall through.
This commit is contained in:
Islam Nofl
2026-05-14 17:32:22 +03:00
parent 55c35cf611
commit e9b8111d93
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
packages/dashboard/src/routes/register-custom-provider-routes.ts
View File

@@ -211,7 +211,8 @@ async function probeProviderModels(
if (parts[0] === 169 && parts[1] === 254) throw badRequest("baseUrl must not be a loopback or private address"); if (parts[0] === 169 && parts[1] === 254) throw badRequest("baseUrl must not be a loopback or private address");
} }
} }
} catch { } catch (err) {
if (err instanceof ApiError) throw err;
// DNS resolution failed — proceed without SSRF check; the fetch will fail naturally // DNS resolution failed — proceed without SSRF check; the fetch will fail naturally
} }