FastGPT S3 Private Object Unauthorized Access Vulnerability Fix

Vulnerability Overview In FastGPT v4.15.0-beta5, there is a cross-origin resource access risk that may occur when S3 private object keys are not bound to authenticated resources. Impact Scope Users utilizing S3 storage without correctly configuring the binding of private object keys. Remediation Fix the cross-origin resource access risk caused by S3 private object keys not being bound to authenticated resources. POC Code Code Optimization Added length protection when the system processes strings. If the length exceeds the limit, synchronous replacement is halted to avoid high CPU load. The upper limit can be adjusted via the environment variable . Other Fixes Workflow tools: Abnormal tool call parameter schema for array and object types. Publishing Channel - Portal: UI offset. New Features HTTP Node: Supports configuring the ignoring of TLS certificate validation, suitable for calling HTTPS services using self-signed or internal certificates. Support for directory depth environment variables to prevent infinite nested directories. Chat dialog box now supports a button for quick scrolling to the bottom. Output animations optimized based on Lobe UI. Support for generating conversation titles via models, requiring the configuration of the variable. Adjusted the editing interaction for Skill Edit. HTTP Node: Supports returning complete error objects. Knowledge Base search in Agent mode now supports permission filtering. Optimized API key logic: Unified APIKey management and pass the application context into requests. Optimized Agent context compression logic. Support for output syntax for quick replies. Optimizations Automatically switch to preview after HTML output to reduce manual operations for opening previews. Optimized display of long names for applications, knowledge bases, files, and folders: automatically truncate when exceeding width and display full content on hover. Removed and from all built-in LLM requests to avoid compatibility issues with some models. Added prompts for errors during knowledge base training, with support for retrying all items with one click. Filtered out invalid knowledge base reference badges. Automatically supplement "none" in tool run responses to avoid errors in some models. Added a second permission check before system tool execution. Optimized SSRF validation after redirection. Fixes Fix the cross-origin resource access risk caused by S3 private object keys not being bound to authenticated resources. Workflow tools: Abnormal tool call parameter schema for array and object types. Publishing Channel - Portal: UI offset. Code Optimization Added length protection when the system processes strings. If the length exceeds the limit, synchronous replacement is halted to avoid high CPU load. The upper limit can be adjusted via the environment variable . New Features HTTP Node: Supports configuring the ignoring of TLS certificate validation, suitable for calling HTTPS services using self-signed or internal certificates. Support for directory depth environment variables to prevent infinite nested directories. Chat dialog box now supports a button for quick scrolling to the bottom. Output animations optimized based on Lobe UI. Support for generating conversation titles via models, requiring the configuration of the variable. Adjusted the editing interaction for Skill Edit. HTTP Node: Supports returning complete error objects. Knowledge Base search in Agent mode now supports permission filtering. Optimized API key logic: Unified APIKey management and pass the application context into requests. Optimized Agent context compression logic. Support for output syntax for quick replies. Optimizations Automatically switch to preview after HTML output to reduce manual operations for opening previews. Optimized display of long names for applications, knowledge bases, files, and folders: automatically truncate when exceeding width and display full content on hover. Removed and from all built-in LLM requests to avoid compatibility issues with some models. Added prompts for errors during knowledge base training, with support for retrying all items with one click. Filtered out invalid knowledge base reference badges. Automatically supplement "none" in tool run responses to avoid errors in some models. Added a second permission check before system tool execution. Optimized SSRF validation after redirection. Fixes Fix the cross-origin resource access risk caused by S3 private object keys not being bound to authenticated resources. Workflow tools: Abnormal tool call parameter schema for array and object types. Publishing Channel - Portal: UI offset. Code Optimization Added length protection when the system processes strings. If the length exceeds the limit, synchronous replacement is halted to avoid high CPU load. The upper limit can be adjusted via the environment variable . New Features HTTP Node: Supports configuring the ignoring of TLS certificate validation, suitable for calling HTTPS services usi

Goal Reached Thanks to every supporter — we hit 100%!

FastGPT S3 Private Object Unauthorized Access Vulnerability Fix

More from this source