wushenghua/sub2api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(grok): keep media content proxy URLs same-origin

Browse Source
This commit is contained in:
Heatherm Huang
2026-07-18 14:43:08 +08:00
parent 3f6b5c7bd7
commit 3edcbfd120
2 changed files with 8 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/internal/service/grok_media.go
+1 -29
View File
@@ -881,33 +881,5 @@ func grokMediaContentProxyURL(c *gin.Context, requestID string) string {
if strings.HasPrefix(c.Request.URL.Path, "/v1/") {
pathPrefix = "/v1"
}
path := pathPrefix + "/videos/" + url.PathEscape(strings.Trim(requestID, "/")) + "/content"
host := strings.TrimSpace(c.GetHeader("X-Forwarded-Host"))
if comma := strings.IndexByte(host, ','); comma >= 0 {
host = strings.TrimSpace(host[:comma])
}
if host == "" {
host = strings.TrimSpace(c.Request.Host)
}
if strings.ContainsAny(host, " \t\r\n") {
return ""
}
scheme := strings.ToLower(strings.TrimSpace(c.GetHeader("X-Forwarded-Proto")))
if comma := strings.IndexByte(scheme, ','); comma >= 0 {
scheme = strings.TrimSpace(scheme[:comma])
}
if scheme != "http" && scheme != "https" {
scheme = strings.ToLower(strings.TrimSpace(c.Request.URL.Scheme))
}
if scheme != "http" && scheme != "https" {
if c.Request.TLS != nil {
scheme = "https"
} else {
scheme = "http"
}
}
if host == "" {
return path
}
return scheme + "://" + host + path
return pathPrefix + "/videos/" + url.PathEscape(strings.Trim(requestID, "/")) + "/content"
}
backend/internal/service/grok_media_content_test.go
+7 -3
View File
@@ -105,7 +105,10 @@ func TestForwardGrokVideoStatusRewritesOnlyProtectedContentURL(t *testing.T) {
},
}
svc := &OpenAIGatewayService{cfg: &config.Config{}, httpUpstream: upstream}
c, recorder := grokMediaContentTestContext(http.MethodGet, "https://api.example/v1/videos/task-1", nil)
c, recorder := grokMediaContentTestContext(http.MethodGet, "https://api.example/v1/videos/task-1", map[string]string{
"X-Forwarded-Host": "malicious.invalid",
"X-Forwarded-Proto": "https",
})
_, err := svc.ForwardGrokMedia(
context.Background(), c, grokMediaContentTestAccount(),
@@ -114,8 +117,9 @@ func TestForwardGrokVideoStatusRewritesOnlyProtectedContentURL(t *testing.T) {
require.NoError(t, err)
require.Equal(t, http.StatusOK, recorder.Code)
require.Equal(t, "https://api.example/v1/videos/task-1/content", gjson.Get(recorder.Body.String(), "url").String())
require.Equal(t, "https://api.example/v1/videos/task-1/content", gjson.Get(recorder.Body.String(), "download_url").String())
require.Equal(t, "/v1/videos/task-1/content", gjson.Get(recorder.Body.String(), "url").String())
require.Equal(t, "/v1/videos/task-1/content", gjson.Get(recorder.Body.String(), "download_url").String())
require.Equal(t, "https://vidgen.x.ai/task-1.mp4", gjson.Get(recorder.Body.String(), "video_url").String())
require.Equal(t, "9007199254740993", gjson.Get(recorder.Body.String(), "counter").String())
require.NotContains(t, recorder.Body.String(), "malicious.invalid")
}