修改了bug

2026-10-07 15:51:13 +08:00
parent 1bff9819ab
commit 168abd3133
10 changed files with 286 additions and 83 deletions
@@ -1,12 +1,13 @@
 import { tool } from "@langchain/core/tools";
 import z from "zod";
+import { checkUrlAllowed } from "./url_guard.js";

 const httpPostTool = tool(
  async ({ url, body, headers = {}, contentType = 'json', timeout = 30000 }) => {
-    try {
-      new URL(url);
-    } catch (e) {
-      return { success: false, error: `Invalid URL: ${url}` };
+    // SSRF 防护：仅允许 http/https 且目标不得为环回/内网地址
+    const blocked = checkUrlAllowed(url);
+    if (blocked) {
+      return { success: false, error: blocked };
    }

    let requestBody;