Files
nofx/mcp/config.go
tinkle-community 7b9a0740c1 fix(security): block SSRF via custom AI model URL
Apply security.ValidateURL() to custom_api_url in PUT /api/models before
storing — blocks private IPs, cloud metadata endpoints, and localhost.
Replace plain http.Client in mcp/config.go with security.SafeHTTPClient()
for defense-in-depth (DialContext blocks private IPs, CheckRedirect
validates targets). Add SSRF warning to WithHTTPClient() docs.
2026-03-10 00:14:01 +08:00

73 lines
1.6 KiB
Go

package mcp
import (
"net/http"
"os"
"strconv"
"time"
"nofx/logger"
"nofx/security"
)
// Config client configuration (centralized management of all configurations)
type Config struct {
// Provider configuration
Provider string
APIKey string
BaseURL string
Model string
// Behavior configuration
MaxTokens int
Temperature float64
UseFullURL bool
// Retry configuration
MaxRetries int
RetryWaitBase time.Duration
RetryableErrors []string
// Timeout configuration
Timeout time.Duration
// Dependency injection
Logger Logger
HTTPClient *http.Client
}
// DefaultConfig returns default configuration
func DefaultConfig() *Config {
return &Config{
// Default values
MaxTokens: getEnvInt("AI_MAX_TOKENS", 2000),
Temperature: MCPClientTemperature,
MaxRetries: MaxRetryTimes,
RetryWaitBase: 2 * time.Second,
Timeout: DefaultTimeout,
RetryableErrors: retryableErrors,
// Default dependencies (use global logger)
Logger: logger.NewMCPLogger(),
HTTPClient: security.SafeHTTPClient(DefaultTimeout),
}
}
// getEnvInt reads integer from environment variable, returns default value if failed
func getEnvInt(key string, defaultValue int) int {
if val := os.Getenv(key); val != "" {
if parsed, err := strconv.Atoi(val); err == nil && parsed > 0 {
return parsed
}
}
return defaultValue
}
// getEnvString reads string from environment variable, returns default value if empty
func getEnvString(key string, defaultValue string) string {
if val := os.Getenv(key); val != "" {
return val
}
return defaultValue
}