Classic298 a2a9a3a42a fix: prevent path traversal via model name in Azure deployment URLs (#23629) ...

The model name from user input was interpolated directly into Azure deployment URL paths without validation. A user could send a model name like '../../management/foo' to traverse the URL path and hit unintended Azure endpoints with the admin's API key.

Adds _sanitize_model_for_url that rejects path separators and traversal sequences, and percent-encodes the name. Applied at convert_to_azure_payload (covers chat completions + proxy) and the responses endpoint's direct URL construction.

2026-04-12 12:29:45 -05:00

..

analytics.py

refac

2026-03-17 17:58:01 -05:00

audio.py

feat: mistral tts

2026-04-02 19:31:15 -05:00

auths.py

fix: prevent first-user admin race in LDAP and OAuth registration (#23626)

2026-04-12 11:28:41 -05:00

automations.py

enh: automation

2026-04-11 17:06:58 -06:00

channels.py

fix(backend): provide fallback strings for webhook UserNameResponse to prevent Pydantic validation error (#23414)

2026-04-11 17:10:11 -06:00

chats.py

refac

2026-04-01 05:55:48 -05:00

configs.py

refac

2026-03-26 18:17:49 -05:00

evaluations.py

chore: format

2026-04-02 08:11:06 -05:00

files.py

refac

2026-04-11 15:23:37 -06:00

folders.py

refac

2026-03-17 17:58:01 -05:00

functions.py

refac

2026-03-24 04:49:48 -05:00

groups.py

refac

2026-03-17 17:58:01 -05:00

images.py

fix: use unique client_id per ComfyUI WebSocket connection (#23592)

2026-04-11 14:55:04 -06:00

knowledge.py

chore: format

2026-03-24 06:07:20 -05:00

memories.py

refac

2026-03-24 04:49:48 -05:00

models.py

refac

2026-04-02 22:34:51 -05:00

notes.py

refac

2026-04-02 02:06:21 -05:00

ollama.py

fix: enforce model access control on Ollama generate, show, embed, embeddings endpoints (#23631)

2026-04-12 12:29:26 -05:00

openai.py

fix: prevent path traversal via model name in Azure deployment URLs (#23629)

2026-04-12 12:29:45 -05:00

pipelines.py

refac

2026-03-24 04:49:48 -05:00

prompts.py

refac

2026-04-02 02:06:21 -05:00

retrieval.py

refac

2026-04-01 05:52:03 -05:00

scim.py

scim: use hmac.compare_digest for bearer token check (#23577)

2026-04-11 14:57:47 -06:00

skills.py

refac

2026-03-17 17:58:01 -05:00

tasks.py

refac

2026-03-17 17:58:01 -05:00

terminals.py

refac

2026-03-29 21:01:10 -05:00

tools.py

refac

2026-04-02 02:06:21 -05:00

users.py

refac

2026-04-01 01:21:21 -05:00

utils.py

refac

2026-03-26 19:01:33 -05:00