shaw
017f6bbd5e
fix(gateway): 收紧上游 URL 路径片段校验
网关有若干位置会把客户端可控的字符串拼进上游请求的 URL path(Responses
子路径、Gemini 模型名)。此前这些字符串未经校验直接参与拼接,可能改变上游
请求的路径结构,使实际发出的请求与客户端意图不一致。
- 新增 internal/service/upstream_path_guard.go:路径片段闭集允许清单
(\w + `-` + `.`),拒绝空片段、纯点片段、超长片段与过深后缀
- /responses/*subpath 三条路由入口新增守卫,不可转发的子路径直接 404;
service 层同时保证不产出不合规后缀,拼接函数再兜底一层
- Gemini AI Studio 原先 5 处重复的 URL 拼接收敛为唯一构造点
buildGeminiAIStudioModelActionURL(校验模型片段 + action 白名单)
- Gemini native / GetModel handler 增加入口校验;ForwardAIStudioGET 逐片段校验
- Grok video 端点的 request_id 增加片段合规校验
合法子路径(/compact、/compact/detail、/{id}/cancel 形态)与既有模型名行为
不变,通配路由保留。
2026-07-31 16:11:45 +08:00
..
2026-07-26 13:43:06 +08:00
2026-07-23 15:50:44 +08:00
2026-07-16 19:57:48 +08:00
2026-07-17 19:15:16 +08:00
2026-07-17 22:10:18 +08:00
2026-07-23 15:50:44 +08:00
2026-07-26 01:56:10 +08:00
2026-07-18 21:05:50 +08:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-31 16:11:45 +08:00
2026-07-27 15:20:03 +00:00
2026-07-28 11:06:33 +08:00
2026-07-17 20:59:29 +08:00
2026-07-23 15:50:44 +08:00
2026-07-25 12:50:46 +08:00
2026-07-25 12:50:46 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 17:21:32 +08:00
2026-07-23 09:19:25 +08:00
2026-07-23 09:19:25 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 17:21:32 +08:00
2026-07-25 22:20:27 +08:00
2026-07-19 12:17:31 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 17:21:32 +08:00
2026-07-25 12:50:46 +08:00
2026-07-28 17:21:32 +08:00
2026-07-26 20:23:50 +09:00
2026-07-26 20:23:50 +09:00
2026-07-26 20:23:50 +09:00
2026-07-18 15:35:30 +08:00
2026-07-26 20:23:50 +09:00
2026-07-18 21:43:54 +08:00
2026-07-18 21:43:54 +08:00
2026-07-25 12:50:46 +08:00
2026-07-21 11:16:04 +08:00
2026-07-25 12:50:46 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 20:02:52 +08:00
2026-07-23 16:43:18 +08:00
2026-07-26 10:14:55 -04:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 17:21:32 +08:00
2026-07-25 19:40:53 +08:00
2026-07-28 17:21:32 +08:00
2026-07-25 19:40:53 +08:00
2026-07-28 17:21:32 +08:00
2026-07-20 15:20:51 +08:00
2026-07-20 15:20:51 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-25 11:22:42 +08:00
2026-07-31 11:49:30 +08:00
2026-07-31 11:49:30 +08:00
2026-07-18 13:53:36 +08:00
2026-07-18 13:53:36 +08:00
2026-07-21 11:55:38 +08:00
2026-07-21 11:55:38 +08:00
2026-07-28 16:19:41 +08:00
2026-07-28 16:19:41 +08:00
2026-07-23 11:18:10 +08:00
2026-07-23 11:18:10 +08:00
2026-07-29 23:25:02 +08:00
2026-07-29 23:25:02 +08:00
2026-07-25 11:22:42 +08:00
2026-07-25 10:20:50 +08:00
2026-07-23 09:20:18 +08:00
2026-07-23 09:20:18 +08:00
2026-07-25 10:20:50 +08:00
2026-07-23 09:20:18 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 17:21:32 +08:00
2026-07-23 15:50:44 +08:00
2026-07-28 16:19:41 +08:00
2026-07-28 12:28:46 +08:00
2026-07-28 12:28:46 +08:00
2026-07-28 12:28:46 +08:00
2026-07-18 20:41:12 +08:00
2026-07-31 11:58:28 +08:00
2026-07-25 15:37:05 +08:00
2026-07-27 19:28:45 +08:00
2026-07-26 21:20:37 +08:00
2026-07-26 21:20:37 +08:00
2026-07-20 21:00:29 +08:00
2026-07-20 21:00:29 +08:00
2026-07-27 08:19:19 +08:00
2026-07-27 08:19:19 +08:00
2026-07-26 17:54:56 +00:00
2026-07-25 21:59:20 +07:00
2026-07-17 22:10:18 +08:00
2026-07-17 22:10:18 +08:00
2026-07-17 22:10:18 +08:00
2026-07-20 22:43:11 +08:00
2026-07-27 19:28:45 +08:00
2026-07-27 00:43:53 +08:00
2026-07-17 21:59:57 +08:00
2026-07-17 21:59:57 +08:00
2026-07-23 09:20:18 +08:00
2026-07-23 09:20:52 +08:00
2026-07-25 15:37:05 +08:00
2026-07-23 10:26:58 +08:00
2026-07-27 00:43:53 +08:00
2026-07-24 03:00:26 +08:00
2026-07-31 16:11:45 +08:00
2026-07-26 09:52:47 +08:00
2026-07-27 13:19:00 +09:00
2026-07-31 16:11:45 +08:00
2026-07-17 22:10:18 +08:00
2026-07-31 16:11:45 +08:00
2026-07-31 16:11:45 +08:00
2026-07-20 10:40:18 +08:00
2026-07-22 13:32:35 +08:00
2026-07-19 12:17:52 +08:00
2026-07-19 12:17:52 +08:00
2026-07-19 12:17:42 +08:00
2026-07-19 12:17:42 +08:00
2026-07-19 22:40:58 +08:00
2026-07-19 22:40:58 +08:00
2026-07-22 13:32:35 +08:00
2026-07-22 13:32:35 +08:00
2026-07-18 14:37:25 +08:00
2026-07-18 14:37:25 +08:00
2026-07-16 18:18:28 +08:00
2026-07-25 12:50:46 +08:00
2026-07-17 15:07:41 +08:00
2026-07-17 15:07:41 +08:00
2026-07-20 15:20:51 +08:00
2026-07-20 15:20:51 +08:00
2026-07-19 00:56:21 -07:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-28 12:28:46 +08:00
2026-07-19 11:23:26 +08:00
2026-07-23 15:50:44 +08:00
2026-07-25 21:59:20 +07:00
2026-07-25 18:34:37 +08:00
2026-07-25 05:31:31 +08:00
2026-07-25 15:37:05 +08:00
2026-07-20 16:12:56 +08:00
2026-07-31 10:30:30 +08:00
2026-07-20 21:44:42 +08:00
2026-07-31 10:30:30 +08:00
2026-07-17 08:44:23 +08:00
2026-07-17 18:12:33 +08:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-27 18:42:34 +08:00
2026-07-27 18:42:34 +08:00
2026-07-20 18:49:24 +08:00
2026-07-24 20:15:58 +08:00
2026-07-27 14:54:01 +08:00
2026-07-27 14:54:01 +08:00
2026-07-17 18:12:33 +08:00
2026-07-25 01:40:26 +08:00
2026-07-22 13:32:35 +08:00
2026-07-22 13:32:35 +08:00
2026-07-19 19:48:25 +08:00
2026-07-19 19:48:25 +08:00
2026-07-19 12:17:23 +08:00
2026-07-19 12:17:23 +08:00
2026-07-25 13:42:35 +08:00
2026-07-21 15:22:12 +08:00
2026-07-17 16:59:40 +08:00
2026-07-24 01:22:34 +08:00
2026-07-21 15:22:12 +08:00
2026-07-22 13:32:35 +08:00
2026-07-20 16:12:56 +08:00
2026-07-26 21:04:18 +08:00
2026-07-22 12:15:48 +08:00
2026-07-22 12:15:48 +08:00
2026-07-25 14:32:18 +08:00
2026-07-27 14:54:01 +08:00
2026-07-27 14:54:01 +08:00
2026-07-27 14:54:01 +08:00
2026-07-17 22:10:18 +08:00
2026-07-23 00:12:28 +08:00
2026-07-28 17:21:32 +08:00
2026-07-26 13:33:56 +08:00
2026-07-31 16:11:45 +08:00
2026-07-19 18:50:33 +08:00
2026-07-20 16:29:12 +08:00
2026-07-19 18:50:33 +08:00
2026-07-23 00:12:28 +08:00
2026-07-31 10:30:30 +08:00
2026-07-31 10:30:30 +08:00
2026-07-31 10:30:30 +08:00
2026-07-22 13:32:35 +08:00
2026-07-27 00:43:53 +08:00
2026-07-16 17:11:00 +08:00
2026-07-17 18:12:33 +08:00
2026-07-17 08:44:23 +08:00
2026-07-17 18:12:33 +08:00
2026-07-25 12:50:46 +08:00
2026-07-27 22:22:46 +08:00
2026-07-25 12:51:20 +08:00
2026-07-25 12:50:46 +08:00
2026-07-27 22:22:46 +08:00
2026-07-28 10:08:39 +08:00
2026-07-28 11:23:53 +08:00
2026-07-24 02:59:32 +08:00
2026-07-22 16:46:29 +08:00
2026-07-31 10:30:30 +08:00
2026-07-31 10:30:30 +08:00
2026-07-21 11:16:04 +08:00
2026-07-21 11:16:04 +08:00
2026-07-25 01:40:26 +08:00
2026-07-24 02:59:32 +08:00
2026-07-24 02:59:32 +08:00
2026-07-24 02:59:32 +08:00
2026-07-18 03:24:04 +08:00
2026-07-25 15:37:06 +08:00
2026-07-25 15:37:05 +08:00
2026-07-18 19:17:53 +08:00
2026-07-16 17:11:00 +08:00
2026-07-26 13:43:06 +08:00
2026-07-21 05:02:30 -07:00
2026-07-24 02:59:32 +08:00
2026-07-16 17:11:00 +08:00
2026-07-26 13:43:06 +08:00
2026-07-26 13:43:06 +08:00
2026-07-26 13:43:06 +08:00
2026-07-26 13:43:06 +08:00
2026-07-18 19:17:53 +08:00
2026-07-18 00:11:18 +08:00
2026-07-29 13:25:03 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:42:16 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-28 12:28:46 +08:00
2026-07-19 11:39:20 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 03:24:04 +08:00
2026-07-28 14:12:46 +08:00
2026-07-28 14:12:46 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-26 03:18:30 +08:00
2026-07-26 03:18:30 +08:00
2026-07-26 03:18:30 +08:00
2026-07-22 19:18:04 +08:00
2026-07-31 09:42:46 +08:00
2026-07-31 09:42:46 +08:00
2026-07-18 15:35:30 +08:00
2026-07-18 20:41:12 +08:00
2026-07-17 22:10:18 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-17 22:10:18 +08:00
2026-07-17 22:10:18 +08:00
2026-07-21 03:07:01 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-28 11:45:18 +08:00
2026-07-27 15:12:51 +08:00
2026-07-27 15:12:51 +08:00
2026-07-28 16:19:41 +08:00
2026-07-28 16:19:41 +08:00
2026-07-28 11:45:18 +08:00
2026-07-27 15:12:51 +08:00
2026-07-28 16:19:41 +08:00
2026-07-28 16:19:41 +08:00
2026-07-18 14:42:22 +08:00
2026-07-19 21:37:26 +08:00
2026-07-18 14:42:22 +08:00
2026-07-28 10:08:39 +08:00
2026-07-28 10:08:39 +08:00
2026-07-25 21:59:20 +07:00
2026-07-29 18:35:56 +08:00
2026-07-17 20:59:29 +08:00
2026-07-17 20:59:29 +08:00
2026-07-22 13:32:35 +08:00
2026-07-22 13:32:35 +08:00
2026-07-31 16:11:45 +08:00
2026-07-31 16:11:45 +08:00
2026-07-27 00:43:53 +08:00
2026-07-25 15:16:05 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 17:21:32 +08:00
2026-07-28 17:21:32 +08:00
2026-07-18 14:42:22 +08:00
2026-07-19 21:37:26 +08:00
2026-07-19 21:37:26 +08:00
2026-07-26 09:50:28 -04:00