From 2b1180f59d06ca6f51e34a2b960e433025bc4a66 Mon Sep 17 00:00:00 2001 From: Duc Nguyen Date: Sat, 4 Apr 2026 07:06:34 +0700 Subject: [PATCH] fix(http): allow localhost URLs for local provider types (Ollama, Claude CLI) (#674) SSRF validation in validateProviderURL() blocked all localhost/loopback addresses, preventing local providers like Ollama from being configured with http://localhost:11434/v1. Introduce localProviderTypes map to skip SSRF checks for inherently local provider types (ollama, claude_cli, acp). Closes #673 --- internal/http/providers.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/internal/http/providers.go b/internal/http/providers.go index 944320c7..31dda011 100644 --- a/internal/http/providers.go +++ b/internal/http/providers.go @@ -237,10 +237,18 @@ func normalizeOllamaAPIBase(p *store.LLMProviderData) { } } +// localProviderTypes are provider types that legitimately run on localhost +// (e.g. Ollama, Claude CLI). SSRF checks are skipped for these. +var localProviderTypes = map[string]bool{ + store.ProviderOllama: true, + store.ProviderClaudeCLI: true, + store.ProviderACP: true, +} + // validateProviderURL rejects provider base URLs pointing to internal/private networks. // Defense-in-depth: prevents SSRF when providers are later used for API calls. func validateProviderURL(rawURL string, providerType string) error { - if rawURL == "" || providerType == store.ProviderACP { + if rawURL == "" || localProviderTypes[providerType] { return nil } u, err := url.Parse(rawURL)