修改了bug

2026-10-07 15:51:13 +08:00
parent 1bff9819ab
commit 168abd3133
10 changed files with 286 additions and 83 deletions
@@ -1,12 +1,13 @@
 import { tool } from 'langchain';
 import * as z from 'zod';
+import { checkUrlAllowed } from './url_guard.js';

 export const httpGetTool = tool(
  async ({ url, headers = {}, timeout = 30000 }) => {
-    try {
-      new URL(url);
-    } catch (e) {
-      return JSON.stringify({ success: false, error: `Invalid URL: ${url}` });
+    // SSRF 防护：仅允许 http/https 且目标不得为环回/内网地址
+    const blocked = checkUrlAllowed(url);
+    if (blocked) {
+      return JSON.stringify({ success: false, error: blocked });
    }

    try {