shaw 8a4dadbbc0 fix(security): 修复余额脚本功能的RCE和SSRF漏洞 ...

- 将 BALANCE_SCRIPT_ENABLED 默认值改为 false，需显式启用
- 添加 isUrlSafe() SSRF防护，禁止访问:
  - localhost/127.x
  - 私有IP (10.x, 172.16-31.x, 192.168.x)
  - AWS metadata (169.254.x)
  - 非HTTP(S)协议

2026-01-07 21:55:08 +08:00

..

anthropicRequestDump.js

feat: 增强稳定性与Antigravity适配 (僵尸流看门狗/自动重试/签名缓存)

2026-01-05 09:37:39 +08:00

anthropicResponseDump.js

feat: 增强稳定性与Antigravity适配 (僵尸流看门狗/自动重试/签名缓存)

2026-01-05 09:37:39 +08:00

antigravityModel.js

feat: 实现 Antigravity OAuth 账户支持与路径分流

2025-12-25 14:33:24 +08:00

antigravityUpstreamDump.js

feat: 增强稳定性与Antigravity适配 (僵尸流看门狗/自动重试/签名缓存)

2026-01-05 09:37:39 +08:00

antigravityUpstreamResponseDump.js

feat: 增强稳定性与Antigravity适配 (僵尸流看门狗/自动重试/签名缓存)

2026-01-05 09:37:39 +08:00

cacheMonitor.js

fix: 修复 ESLint 错误和代码格式问题

2025-08-17 16:54:08 +08:00

contents.js

fix: 添加 Explore agent 系统提示词模板并优化日志级别

2025-12-08 10:45:46 +08:00

costCalculator.js

fix: 🐛 fee calc fix

2025-10-02 13:09:19 +08:00

dateHelper.js

feat: 添加精确的账户费用计算和时区支持

2025-09-01 11:29:16 +08:00

errorSanitizer.js

feat: 实现 Antigravity OAuth 账户支持与路径分流

2025-12-25 14:33:24 +08:00

featureFlags.js

fix(security): 修复余额脚本功能的RCE和SSRF漏洞

2026-01-07 21:55:08 +08:00

geminiSchemaCleaner.js

feat: 实现 Antigravity OAuth 账户支持与路径分流

2025-12-25 14:33:24 +08:00

headerFilter.js

fix: 统一格式化claude参数传递

2025-12-08 14:23:13 +08:00

inputValidator.js

feat: LDAP适配深色模式

2025-09-02 14:43:30 +08:00

logger.js

feat: 添加用户消息串行队列功能，防止同账户并发请求触发限流

2025-12-09 17:04:01 +08:00

lruCache.js

fix: 修复 ESLint 错误和代码格式问题

2025-08-17 16:54:08 +08:00

modelHelper.js

feat: 实现 Antigravity OAuth 账户支持与路径分流

2025-12-25 14:33:24 +08:00

oauthHelper.js

feat: 支持sessionKey完成oauth授权

2025-12-02 20:43:47 +08:00

projectPaths.js

feat: 实现 Antigravity OAuth 账户支持与路径分流

2025-12-25 14:33:24 +08:00

proxyHelper.js

perf(proxy): cache agents with opt-in pooling

2025-11-22 05:01:46 -08:00

rateLimitHelper.js

feat: openai转发增加apikey速率限制

2025-10-08 08:36:43 +08:00

runtimeAddon.js

fix: droid转发增加runtimeAddon调试插件

2025-10-15 15:17:20 +08:00

safeRotatingAppend.js

feat: 增强稳定性与Antigravity适配 (僵尸流看门狗/自动重试/签名缓存)

2026-01-05 09:37:39 +08:00

sessionHelper.js

refactor(sessionHelper): Extract session ID directly from metadata.user_id

2025-09-04 10:26:40 +08:00

signatureCache.js

feat: 增强稳定性与Antigravity适配 (僵尸流看门狗/自动重试/签名缓存)

2026-01-05 09:37:39 +08:00

sseParser.js

修复标准Gemini API流式响应的缓冲区和解析问题

2025-11-14 11:17:14 +08:00

statsHelper.js

feat: enhance concurrency queue with health check and admin endpoints

2025-12-12 14:32:09 +08:00

streamHelper.js

feat: enhance concurrency queue with health check and admin endpoints

2025-12-12 14:32:09 +08:00

testPayloadHelper.js

fix: 增强console账号test端点

2025-12-01 15:08:40 +08:00

tokenMask.js

feat: 新增Droid cli支持

2025-10-09 23:05:09 +08:00

tokenRefreshLogger.js

refactor: standardize code formatting and linting configuration

2025-08-07 18:19:31 +09:00

unstableUpstreamHelper.js

fix: 修复 ESLint curly 规则问题

2025-12-05 02:28:30 +08:00

warmupInterceptor.js

feat: claude账号新增支持拦截预热请求

2025-12-21 22:28:22 +08:00

webhookNotifier.js

feat: 新增 OpenAI-Responses 账户管理功能和独立自动停止标记机制

2025-09-10 15:41:52 +08:00

workosOAuthHelper.js

fix: 修复因代理ip不可用导致axios的proxy回退到环境变量代理问题

2025-10-18 11:00:43 +08:00