Fix: Upstream URL path fragment validation bypass vulnerability

Vulnerability Overview This vulnerability involves the validation of upstream URL path fragments, which may allow illegal requests to be processed, thereby leading to security issues. Impact Scope Affected paths: Subpaths of (after being forwarded to the same-name upstream node). Affected models: Model names in Gemini AI Studio (Native path extraction takes upstream URL fragments; compact routing is determined by the field in the request body, which may subsequently undergo compact mapping). Remediation Plan 1. Add : Serves as the unified validation entry point for path fragments. - Allowlist: Only allows (e.g., ) and the necessary and characters for actual values. - Additional Rejections: Empty fragments, fragments consisting only of dots, excessively long fragments, and excessive suffixes. - Validation Only, No Rewriting: Invalid fragments directly result in an error without automatic correction. 2. Path Handling: - (Routes , no model name, and /codex, totaling three routes) - Added at the entry point: Subpaths that cannot be forwarded directly return a 404, bypassing the scheduling and forwarding processes, and are rejected locally without being counted in ops (not counted in SLA/error rate). - The in the service layer generates this non-compliant suffix; only compliant fragments are concatenated into the upstream URL. 3. Gemini AI Studio: - The previous five repetitive instances of have been consolidated into a single construction point (validating model fragments + action allowlist + unified handling of ); all new endpoints must go through this. - Added entry validation to / , allowing clients to receive a 400 error directly rather than waiting for an error during upstream request construction. - Added validation to the incoming path in . 4. Grok: - For the video endpoint's , in addition to existing , added validation for pure dot fragments and control characters. Compatibility Legal subpaths (patterns such as , , ) and existing model name behaviors remain completely unchanged; the wildcard route is preserved and not converted to fixed paths to avoid impacting legitimate clients. Non-compliant requests: Subpaths return 404, model names return 400. Construction points that do not require modification after rollback: Bedrock (models must match the mapping table), backend, vendor prefix allowlist, Vertex Gemini and Anthropic ( + fragment appending), action (regex), action (allowlist), Antigravity (action allowlist + model from body, fixed path), Gemini batch CreateBatch, Codex models' ( + ), WS upstream URLs (constructed solely by pool configuration). Testing Added : A matrix of acceptance/rejection cases for the guard (40+ cases), covering compact external subpaths, pure dot fragments, empty fragments, boundary lengths, common cases, and untested cases regarding subpath extraction and concatenation. Added : Tests for normal values and illegal model names/actions in URL construction points. : Added route-level cases: non-compliant subpaths are rejected at the entry point. Local runs: , , and full package runs for (OpenAI / Gemini / Grok / Compact / Responses / Upstream / AccountTest / Bedrock / Vertex), , , and , all passed successfully. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Fix: Upstream URL path fragment validation bypass vulnerability

More from this source