From be0884264229975987fe8bcf1d6b21552c7cae9b Mon Sep 17 00:00:00 2001 From: KingBoyAndGirl Date: Wed, 29 Apr 2026 13:45:52 +0800 Subject: [PATCH] fix: trust custom provider base_url in SSRF validation When using custom providers with private IPs (like AxonHub on internal networks), the SSRF protection incorrectly blocks API calls to the user's own configured endpoint. This fix automatically adds the model.base_url hostname to the SSRF trusted hosts list, since it's explicitly configured by the user. Fixes issues where /api/models and /v1/* endpoints fail silently when using custom providers with private IPs or IPv6 addresses. --- api/config.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/api/config.py b/api/config.py index 81df3099..af94926d 100644 --- a/api/config.py +++ b/api/config.py @@ -1524,6 +1524,11 @@ def get_available_models() -> dict: # Build set of hostnames from custom_providers config — these are # user-explicitly configured endpoints and should not be blocked by SSRF. _ssrf_trusted_hosts: set[str] = set() + # Also trust the base_url from model config (explicitly configured by user) + if cfg_base_url: + _base_parsed = urlparse(cfg_base_url if "://" in cfg_base_url else f"http://{cfg_base_url}") + if _base_parsed.hostname: + _ssrf_trusted_hosts.add(_base_parsed.hostname.lower()) _custom_providers_cfg = cfg.get("custom_providers", []) if isinstance(_custom_providers_cfg, list): for _cp in _custom_providers_cfg: