GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api

middleware

package

v0.10.9-alpha.3 Latest Latest Go to latest Published: Feb 8, 2026 License: AGPL-3.0 Imports: 33 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/QuantumNous/new-api

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func AdminAuth() func(c *gin.Context)
func BodyStorageCleanup() gin.HandlerFunc
func CORS() gin.HandlerFunc
func Cache() func(c *gin.Context)
func ClearSecureVerification(c *gin.Context)
func CriticalRateLimit() func(c *gin.Context)
func DecompressRequestMiddleware() gin.HandlerFunc
func DisableCache() gin.HandlerFunc
func Distribute() func(c *gin.Context)
func DownloadRateLimit() func(c *gin.Context)
func EmailVerificationRateLimit() gin.HandlerFunc
func GetLanguage(c *gin.Context) string
func GlobalAPIRateLimit() func(c *gin.Context)
func GlobalWebRateLimit() func(c *gin.Context)
func I18n() gin.HandlerFunc
func JimengRequestConvert() func(c *gin.Context)
func KlingRequestConvert() func(c *gin.Context)
func ModelRequestRateLimit() func(c *gin.Context)
func OptionalSecureVerification() gin.HandlerFunc
func PoweredBy() gin.HandlerFunc
func RelayPanicRecover() gin.HandlerFunc
func RequestId() func(c *gin.Context)
func RootAuth() func(c *gin.Context)
func SearchRateLimit() func(c *gin.Context)
func SecureVerificationRequired() gin.HandlerFunc
func SetUpLogger(server *gin.Engine)
func SetupContextForSelectedChannel(c *gin.Context, channel *model.Channel, modelName string) *types.NewAPIError
func SetupContextForToken(c *gin.Context, token *model.Token, parts ...string) error
func StatsMiddleware() gin.HandlerFunc
func SystemPerformanceCheck() gin.HandlerFunc
func TokenAuth() func(c *gin.Context)
func TokenAuthReadOnly() func(c *gin.Context)
func TryUserAuth() func(c *gin.Context)
func TurnstileCheck() gin.HandlerFunc
func UploadRateLimit() func(c *gin.Context)
func UserAuth() func(c *gin.Context)
func WssAuth(c *gin.Context)
type HTTPStats
type ModelRequest
type StatsInfo
- func GetStats() StatsInfo

Constants ¶

View Source

const (
	EmailVerificationRateLimitMark = "EV"
	EmailVerificationMaxRequests   = 2  // 30秒内最多2次
	EmailVerificationDuration      = 30 // 30秒时间窗口
)

View Source

const (
	ModelRequestRateLimitCountMark        = "MRRL"
	ModelRequestRateLimitSuccessCountMark = "MRRLS"
)

View Source

const (
	// SecureVerificationSessionKey 安全验证的 session key（与 controller 保持一致）
	SecureVerificationSessionKey = "secure_verified_at"
	// SecureVerificationTimeout 验证有效期（秒）
	SecureVerificationTimeout = 300 // 5分钟
)

Variables ¶

This section is empty.

Functions ¶

func AdminAuth ¶

func AdminAuth() func(c *gin.Context)

func BodyStorageCleanup ¶

func BodyStorageCleanup() gin.HandlerFunc

BodyStorageCleanup 请求体存储清理中间件在请求处理完成后自动清理磁盘/内存缓存

func CORS ¶

func CORS() gin.HandlerFunc

func Cache ¶

func Cache() func(c *gin.Context)

func ClearSecureVerification ¶

func ClearSecureVerification(c *gin.Context)

ClearSecureVerification 清除安全验证状态用于用户登出或需要强制重新验证的场景

func CriticalRateLimit ¶

func CriticalRateLimit() func(c *gin.Context)

func DecompressRequestMiddleware ¶

func DecompressRequestMiddleware() gin.HandlerFunc

func DisableCache ¶

func DisableCache() gin.HandlerFunc

func Distribute ¶

func Distribute() func(c *gin.Context)

func DownloadRateLimit ¶

func DownloadRateLimit() func(c *gin.Context)

func EmailVerificationRateLimit ¶

func EmailVerificationRateLimit() gin.HandlerFunc

func GetLanguage ¶ added in v0.10.8

func GetLanguage(c *gin.Context) string

GetLanguage returns the current language from gin context

func GlobalAPIRateLimit ¶

func GlobalAPIRateLimit() func(c *gin.Context)

func GlobalWebRateLimit ¶

func GlobalWebRateLimit() func(c *gin.Context)

func I18n ¶ added in v0.10.8

func I18n() gin.HandlerFunc

I18n middleware detects and sets the language preference for the request

func JimengRequestConvert ¶

func JimengRequestConvert() func(c *gin.Context)

func KlingRequestConvert ¶

func KlingRequestConvert() func(c *gin.Context)

func ModelRequestRateLimit ¶

func ModelRequestRateLimit() func(c *gin.Context)

ModelRequestRateLimit 模型请求限流中间件

func OptionalSecureVerification ¶

func OptionalSecureVerification() gin.HandlerFunc

OptionalSecureVerification 可选的安全验证中间件如果用户已验证，则在 context 中设置标记，但不阻止请求继续用于某些需要区分是否已验证的场景

func PoweredBy ¶

func PoweredBy() gin.HandlerFunc

func RelayPanicRecover ¶

func RelayPanicRecover() gin.HandlerFunc

func RequestId ¶

func RequestId() func(c *gin.Context)

func RootAuth ¶

func RootAuth() func(c *gin.Context)

func SearchRateLimit ¶ added in v0.10.8

func SearchRateLimit() func(c *gin.Context)

SearchRateLimit returns a per-user rate limiter for search endpoints. 10 requests per 60 seconds per user (by user ID, not IP).

func SecureVerificationRequired ¶

func SecureVerificationRequired() gin.HandlerFunc

SecureVerificationRequired 安全验证中间件检查用户是否在有效时间内通过了安全验证如果未验证或验证已过期，返回 401 错误

func SetUpLogger ¶

func SetUpLogger(server *gin.Engine)

func SetupContextForSelectedChannel ¶

func SetupContextForSelectedChannel(c *gin.Context, channel *model.Channel, modelName string) *types.NewAPIError

func SetupContextForToken ¶

func SetupContextForToken(c *gin.Context, token *model.Token, parts ...string) error

func StatsMiddleware ¶

func StatsMiddleware() gin.HandlerFunc

StatsMiddleware 统计中间件

func SystemPerformanceCheck ¶ added in v0.10.8

func SystemPerformanceCheck() gin.HandlerFunc

SystemPerformanceCheck 检查系统性能中间件

func TokenAuth ¶

func TokenAuth() func(c *gin.Context)

func TokenAuthReadOnly ¶ added in v0.10.8

func TokenAuthReadOnly() func(c *gin.Context)

TokenAuthReadOnly 宽松版本的令牌认证中间件，用于只读查询接口。只验证令牌 key 是否存在，不检查令牌状态、过期时间和额度。即使令牌已过期、已耗尽或已禁用，也允许访问。仍然检查用户是否被封禁。

func TryUserAuth ¶

func TryUserAuth() func(c *gin.Context)

func TurnstileCheck ¶

func TurnstileCheck() gin.HandlerFunc

func UploadRateLimit ¶

func UploadRateLimit() func(c *gin.Context)

func UserAuth ¶

func UserAuth() func(c *gin.Context)

func WssAuth ¶

func WssAuth(c *gin.Context)

Types ¶

type HTTPStats ¶

type HTTPStats struct {
	// contains filtered or unexported fields
}

HTTPStats 存储HTTP统计信息

type ModelRequest ¶

type ModelRequest struct {
	Model string `json:"model"`
	Group string `json:"group,omitempty"`
}

type StatsInfo ¶

type StatsInfo struct {
	ActiveConnections int64 `json:"active_connections"`
}

StatsInfo 统计信息结构

func GetStats ¶

func GetStats() StatsInfo

GetStats 获取统计信息

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Documentation ¶

Index ¶

Constants ¶

Variables ¶

Functions ¶

func AdminAuth ¶

func BodyStorageCleanup ¶

func CORS ¶

func Cache ¶

func ClearSecureVerification ¶

func CriticalRateLimit ¶

func DecompressRequestMiddleware ¶

func DisableCache ¶

func Distribute ¶

func DownloadRateLimit ¶

func EmailVerificationRateLimit ¶

func GetLanguage ¶ added in v0.10.8

func GlobalAPIRateLimit ¶

func GlobalWebRateLimit ¶

func I18n ¶ added in v0.10.8

func JimengRequestConvert ¶

func KlingRequestConvert ¶

func ModelRequestRateLimit ¶

func OptionalSecureVerification ¶

func PoweredBy ¶

func RelayPanicRecover ¶

func RequestId ¶

func RootAuth ¶

func SearchRateLimit ¶ added in v0.10.8

func SecureVerificationRequired ¶

func SetUpLogger ¶

func SetupContextForSelectedChannel ¶

func SetupContextForToken ¶

func StatsMiddleware ¶

func SystemPerformanceCheck ¶ added in v0.10.8

func TokenAuth ¶

func TokenAuthReadOnly ¶ added in v0.10.8

func TryUserAuth ¶

func TurnstileCheck ¶

func UploadRateLimit ¶

func UserAuth ¶

func WssAuth ¶

Types ¶

type HTTPStats ¶

type ModelRequest ¶

type StatsInfo ¶

func GetStats ¶

Source Files ¶