mirror of
https://github.com/QuantumNous/new-api.git
synced 2026-10-28 16:46:57 +08:00
RedwindA
19d435e7fd
* fix(relay): mask only the upstream address in error messages MaskSensitiveInfo masked every URL, domain and IPv4 in upstream error messages, which garbled documentation links, email domains and dotted identifiers that clients need to read. It now takes the upstream addresses of the request: the channel base URL, the origin the gateway actually dialed (recorded in doRequest, DoWssRequest, the AWS SDK client and the Xunfei and Volcengine TTS dials, which covers absolute Advanced Custom routes), the channel proxy and the environment proxy. URLs and bare hostnames on those hosts and all IPv4 addresses are masked; other URLs and domains stay readable. With no upstream address no address is masked. Credentials are masked on every URL regardless of host: api_key values, query values and userinfo. The URL matcher also keeps quotes, colons and semicolons that follow a URL, keeps parentheses and apostrophes inside it, masks an IPv4 URL host whole and keeps a country-code TLD when the host has a port. * fix(relay): keep preset official endpoints readable in masked errors A channel on the base URL new-api presets for its type reaches a public official endpoint, so its address is not masked. Only addresses the admin configured are: a custom base URL, the origin of an Advanced Custom route, and the channel and environment proxies. Preset hosts are compared with their port so a configured localhost upstream stays apart from the Ollama preset. The origins recorded for the AWS SDK, Xunfei and Volcengine TTS dials and the plugin allowedHosts masking are dropped: they are all official endpoints. * fix(relay): mask IPv4 addresses and plugin allowed hosts in every error IPv4 addresses in network errors include the gateway's own address, so they are masked even when the channel uses a preset base URL. Task plugin build failures mask the plugin's allowedHosts again: an installed plugin may point them at private hosts. * fix(relay): mask bracketed IPv6 addresses in errors Go network errors write IPv6 addresses in brackets, as in "dial tcp [2001:db8::1]:443". Like IPv4, they are the resolved upstream or the gateway's own address, so they are masked on every error once the bracketed content parses as an IP.
141 lines
3.1 KiB
Go
141 lines
3.1 KiB
Go
package common
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"fmt"
|
|
"slices"
|
|
"strconv"
|
|
"strings"
|
|
"unsafe"
|
|
|
|
kitutil "github.com/QuantumNous/new-api/relaykit/relayconvert/kitutil"
|
|
|
|
"github.com/samber/lo"
|
|
)
|
|
|
|
const LocalLogContentLimit = 2048
|
|
|
|
// LocalLogPreview limits log-only content unless debug logging is enabled.
|
|
func LocalLogPreview(content string) string {
|
|
if DebugEnabled || len(content) <= LocalLogContentLimit {
|
|
return content
|
|
}
|
|
return fmt.Sprintf("%s... [truncated, original_length=%d, limit=%d]", content[:LocalLogContentLimit], len(content), LocalLogContentLimit)
|
|
}
|
|
|
|
func GetStringIfEmpty(str string, defaultValue string) string {
|
|
if str == "" {
|
|
return defaultValue
|
|
}
|
|
return str
|
|
}
|
|
|
|
func GetRandomString(length int) string {
|
|
if length <= 0 {
|
|
return ""
|
|
}
|
|
return lo.RandomString(length, lo.AlphanumericCharset)
|
|
}
|
|
|
|
func MapToJsonStr(m map[string]any) string {
|
|
bytes, err := json.Marshal(m)
|
|
if err != nil {
|
|
return ""
|
|
}
|
|
return string(bytes)
|
|
}
|
|
|
|
func StrToMap(str string) (map[string]any, error) {
|
|
m := make(map[string]any)
|
|
err := Unmarshal([]byte(str), &m)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return m, nil
|
|
}
|
|
|
|
func StrToJsonArray(str string) ([]any, error) {
|
|
var js []any
|
|
err := json.Unmarshal([]byte(str), &js)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return js, nil
|
|
}
|
|
|
|
func IsJsonArray(str string) bool {
|
|
var js []any
|
|
return json.Unmarshal([]byte(str), &js) == nil
|
|
}
|
|
|
|
func IsJsonObject(str string) bool {
|
|
var js map[string]any
|
|
return json.Unmarshal([]byte(str), &js) == nil
|
|
}
|
|
|
|
func String2Int(str string) int {
|
|
num, err := strconv.Atoi(str)
|
|
if err != nil {
|
|
return 0
|
|
}
|
|
return num
|
|
}
|
|
|
|
func StringsContains(strs []string, str string) bool {
|
|
return slices.Contains(strs, str)
|
|
}
|
|
|
|
// StringToByteSlice []byte only read, panic on append
|
|
func StringToByteSlice(s string) []byte {
|
|
tmp1 := (*[2]uintptr)(unsafe.Pointer(&s))
|
|
tmp2 := [3]uintptr{tmp1[0], tmp1[1], tmp1[1]}
|
|
return *(*[]byte)(unsafe.Pointer(&tmp2))
|
|
}
|
|
|
|
func EncodeBase64(str string) string {
|
|
return base64.StdEncoding.EncodeToString([]byte(str))
|
|
}
|
|
|
|
func GetJsonString(data any) string {
|
|
if data == nil {
|
|
return ""
|
|
}
|
|
b, _ := json.Marshal(data)
|
|
return string(b)
|
|
}
|
|
|
|
// NormalizeBillingPreference clamps the billing preference to valid values.
|
|
func NormalizeBillingPreference(pref string) string {
|
|
switch strings.TrimSpace(pref) {
|
|
case "subscription_first", "wallet_first", "subscription_only", "wallet_only":
|
|
return strings.TrimSpace(pref)
|
|
default:
|
|
return "subscription_first"
|
|
}
|
|
}
|
|
|
|
// MaskEmail masks a user email to prevent PII leakage in logs
|
|
// Returns "***masked***" if email is empty, otherwise shows only the domain part
|
|
func MaskEmail(email string) string {
|
|
if email == "" {
|
|
return "***masked***"
|
|
}
|
|
|
|
// Find the @ symbol
|
|
_, after, ok := strings.Cut(email, "@")
|
|
if !ok {
|
|
// No @ symbol found, return masked
|
|
return "***masked***"
|
|
}
|
|
|
|
// Return only the domain part with @ symbol
|
|
return "***@" + after
|
|
}
|
|
|
|
// MaskSensitiveInfo moved to the conversion kit (kitutil) because the types
|
|
// package error formatting depends on it; host callers keep this name.
|
|
func MaskSensitiveInfo(str string, upstreamURLs ...string) string {
|
|
return kitutil.MaskSensitiveInfo(str, upstreamURLs...)
|
|
}
|