feat: 修复 WebSocket 越权与 AI 流 SSRF

2026-08-14 00:45:22 +08:00
parent 1a29def480
commit 839ba91354
17 changed files with 614 additions and 136 deletions
@@ -8,3 +8,11 @@ MODEL_LABELS = os.getenv("MODEL_LABELS", "healthy,sick").split(",")
 # mock 模式返回的固定结果
 MOCK_CLASS = os.getenv("MOCK_CLASS", "healthy")
 MOCK_CONFIDENCE = float(os.getenv("MOCK_CONFIDENCE", "0.95"))
+INTERNAL_API_KEY = os.getenv("INTERNAL_API_KEY", "silk-internal-2026")
+ALLOWED_STREAM_HOSTS = [
+    item.strip()
+    for item in os.getenv("ALLOWED_STREAM_HOSTS", "localhost,127.0.0.1,100.83.103.1").split(",")
+    if item.strip()
+]
+STREAM_TASK_MAX_WORKERS = int(os.getenv("STREAM_TASK_MAX_WORKERS", "2"))
+STREAM_TASK_MAX_FRAMES = int(os.getenv("STREAM_TASK_MAX_FRAMES", "10"))