old-actions/code-review
2
0
Fork 0
Code Pull Requests Actions Releases 2 Activity

fix(ai-review 使用量): OpenRouter 額度查詢改為精確 hostname 比對

Browse Source
This commit is contained in:
Jeffery
2026-06-23 13:15:58 +08:00
parent 348036aea3
commit e73e18f2c3
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/usage.js
+4 -4
View File
@@ -125,13 +125,13 @@ export function resetRateLimit() {
const stripSlash = (s) => String(s || '').replace(/\/$/, ''); const stripSlash = (s) => String(s || '').replace(/\/$/, '');
/** /**
* 以實際 hostname 精確比對是否為 OpenRouter，避免被偽造的 baseURL * 以實際 hostname 精確比對是否為 OpenRouter（僅接受 apex 域名 `openrouter.ai`），
* （如 `openrouter.ai.evil.com` 或 `evil.com/openrouter.ai`）矇騙而把 API key 送往惡意主機。 * 避免被偽造的 baseURL（如 `openrouter.ai.evil.com`、`evil.com/openrouter.ai` 或任何子網域）
* 矇騙而把 API key 送往非 OpenRouter 主機。
*/ */
function isOpenRouterBaseURL(baseURL) { function isOpenRouterBaseURL(baseURL) {
try { try {
const host = new URL(baseURL).hostname.toLowerCase(); return new URL(baseURL).hostname.toLowerCase() === 'openrouter.ai';
return host === 'openrouter.ai' || host.endsWith('.openrouter.ai');
} catch { } catch {
return false; return false;
} }