GO-2025-4154: new-api is vulnerable to SSRF Bypass in one-api

taskcommon

package

v0.11.0 Latest Latest Go to latest Published: Feb 28, 2026 License: AGPL-3.0 Imports: 7 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/QuantumNous/new-api

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func BuildProxyURL(taskID string) string
func DecodeLocalTaskID(id string) (string, error)
func DefaultInt(val, fallback int) int
func DefaultString(val, fallback string) string
func EncodeLocalTaskID(name string) string
func UnmarshalMetadata(metadata map[string]any, target any) error
type BaseBilling

Constants ¶

View Source

const (
	ProgressSubmitted  = "10%"
	ProgressQueued     = "20%"
	ProgressInProgress = "30%"
	ProgressComplete   = "100%"
)

Status-to-progress mapping constants for polling updates.

Variables ¶

This section is empty.

Functions ¶

func BuildProxyURL ¶

func BuildProxyURL(taskID string) string

BuildProxyURL constructs the video proxy URL using the public task ID. e.g., "https://your-server.com/v1/videos/task_xxxx/content"

func DecodeLocalTaskID ¶

func DecodeLocalTaskID(id string) (string, error)

DecodeLocalTaskID decodes a base64-encoded upstream operation name.

func DefaultInt ¶

func DefaultInt(val, fallback int) int

DefaultInt returns val if non-zero, otherwise fallback.

func DefaultString ¶

func DefaultString(val, fallback string) string

DefaultString returns val if non-empty, otherwise fallback.

func EncodeLocalTaskID ¶

func EncodeLocalTaskID(name string) string

EncodeLocalTaskID encodes an upstream operation name to a URL-safe base64 string. Used by Gemini/Vertex to store upstream names as task IDs.

func UnmarshalMetadata ¶

func UnmarshalMetadata(metadata map[string]any, target any) error

UnmarshalMetadata converts a map[string]any metadata to a typed struct via JSON round-trip. This replaces the repeated pattern: json.Marshal(metadata) → json.Unmarshal(bytes, &target).

Types ¶

type BaseBilling ¶

type BaseBilling struct{}

func (BaseBilling) AdjustBillingOnComplete ¶

func (BaseBilling) AdjustBillingOnComplete(_ *model.Task, _ *relaycommon.TaskInfo) int

AdjustBillingOnComplete returns 0 (keep pre-charged amount).

func (BaseBilling) AdjustBillingOnSubmit ¶

func (BaseBilling) AdjustBillingOnSubmit(_ *relaycommon.RelayInfo, _ []byte) map[string]float64

AdjustBillingOnSubmit returns nil (no submit-time adjustment).

func (BaseBilling) EstimateBilling ¶

func (BaseBilling) EstimateBilling(_ *gin.Context, _ *relaycommon.RelayInfo) map[string]float64

EstimateBilling returns nil (no extra ratios; use base model price).

Source Files ¶

View all Source files

helpers.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL