From e73e18f2c3f09f96a04d7d196d3f05d93e49d4cb Mon Sep 17 00:00:00 2001
From: Jeffery <h3285@evertrust.com.tw>
Date: Tue, 23 Jun 2026 13:15:58 +0800
Subject: [PATCH] =?UTF-8?q?fix(ai-review=20=E4=BD=BF=E7=94=A8=E9=87=8F):?=
 =?UTF-8?q?=20OpenRouter=20=E9=A1=8D=E5=BA=A6=E6=9F=A5=E8=A9=A2=E6=94=B9?=
 =?UTF-8?q?=E7=82=BA=E7=B2=BE=E7=A2=BA=20hostname=20=E6=AF=94=E5=B0=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/usage.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/usage.js b/app/usage.js
index 8829358..0dab83a 100644
--- a/app/usage.js
+++ b/app/usage.js
@@ -125,13 +125,13 @@ export function resetRateLimit() {
 const stripSlash = (s) => String(s || '').replace(/\/$/, '');
 
 /**
- * 以實際 hostname 精確比對是否為 OpenRouter，避免被偽造的 baseURL
- * （如 `openrouter.ai.evil.com` 或 `evil.com/openrouter.ai`）矇騙而把 API key 送往惡意主機。
+ * 以實際 hostname 精確比對是否為 OpenRouter（僅接受 apex 域名 `openrouter.ai`），
+ * 避免被偽造的 baseURL（如 `openrouter.ai.evil.com`、`evil.com/openrouter.ai` 或任何子網域）
+ * 矇騙而把 API key 送往非 OpenRouter 主機。
  */
 function isOpenRouterBaseURL(baseURL) {
   try {
-    const host = new URL(baseURL).hostname.toLowerCase();
-    return host === 'openrouter.ai' || host.endsWith('.openrouter.ai');
+    return new URL(baseURL).hostname.toLowerCase() === 'openrouter.ai';
   } catch {
     return false;
   }