-
-
Notifications
You must be signed in to change notification settings - Fork 1.4k
fix: cannot automatically get embedding dim when create embedding provider #5442
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
b13bf36
64ae120
5b31476
fd3c337
0e5946a
4763cb5
e28a75f
6620f2b
227eb1a
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -754,6 +754,22 @@ async def get_embedding_dim(self): | |
| if not provider_type: | ||
| return Response().error("provider_config 缺少 type 字段").__dict__ | ||
|
|
||
| # 首次添加某类提供商时,provider_cls_map 可能尚未注册该适配器 | ||
| if provider_type not in provider_cls_map: | ||
| try: | ||
| self.core_lifecycle.provider_manager.dynamic_import_provider( | ||
| provider_type, | ||
| ) | ||
|
Comment on lines
+760
to
+762
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The Recommendation: Validate |
||
| except ImportError: | ||
| logger.error(traceback.format_exc()) | ||
| return ( | ||
| Response() | ||
| .error( | ||
| "提供商适配器加载失败,请检查提供商类型配置或查看服务端日志" | ||
| ) | ||
| .__dict__ | ||
| ) | ||
|
|
||
| # 获取对应的 provider 类 | ||
| if provider_type not in provider_cls_map: | ||
| return ( | ||
|
|
@@ -779,7 +795,7 @@ async def get_embedding_dim(self): | |
| if inspect.iscoroutinefunction(init_fn): | ||
| await init_fn() | ||
|
|
||
| # 获取嵌入向量维度 | ||
| # 通过实际请求验证当前 embedding_dimensions 是否可用 | ||
| vec = await inst.get_embedding("echo") | ||
| dim = len(vec) | ||
|
|
||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The
embedding_api_baseis taken directly from the user-provided configuration and used as the base URL for the OpenAI client without any validation. This allows an attacker to perform Server-Side Request Forgery (SSRF) by providing internal IP addresses or malicious domains, which the server will then attempt to connect to during the dimension detection process.Recommendation: Validate the
api_baseURL to ensure it does not point to internal or reserved IP addresses.