@lobehub/chat 1.29.1 → 1.29.3

package/CHANGELOG.md

@@ -2,6 +2,56 @@
 
 # Changelog
 
+### [Version 1.29.3](https://github.com/lobehub/lobe-chat/compare/v1.29.2...v1.29.3)
+
+<sup>Released on **2024-11-09**</sup>
+
+#### 🐛 Bug Fixes
+
+- **misc**: Fix the display model of history summary.
+
+<br/>
+
+<details>
+<summary><kbd>Improvements and Fixes</kbd></summary>
+
+#### What's fixed
+
+- **misc**: Fix the display model of history summary, closes [#4656](https://github.com/lobehub/lobe-chat/issues/4656) ([66cf2c1](https://github.com/lobehub/lobe-chat/commit/66cf2c1))
+
+</details>
+
+<div align="right">
+
+[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)
+
+</div>
+
+### [Version 1.29.2](https://github.com/lobehub/lobe-chat/compare/v1.29.1...v1.29.2)
+
+<sup>Released on **2024-11-09**</sup>
+
+#### 💄 Styles
+
+- **misc**: Allow users to disable SSRF or set a whitelist.
+
+<br/>
+
+<details>
+<summary><kbd>Improvements and Fixes</kbd></summary>
+
+#### Styles
+
+- **misc**: Allow users to disable SSRF or set a whitelist, closes [#4633](https://github.com/lobehub/lobe-chat/issues/4633) ([7175145](https://github.com/lobehub/lobe-chat/commit/7175145))
+
+</details>
+
+<div align="right">
+
+[![](https://img.shields.io/badge/-BACK_TO_TOP-151515?style=flat-square)](#readme-top)
+
+</div>
+
 ### [Version 1.29.1](https://github.com/lobehub/lobe-chat/compare/v1.29.0...v1.29.1)
 
 <sup>Released on **2024-11-09**</sup>

package/docs/self-hosting/environment-variables/basic.mdx

@@ -93,6 +93,20 @@ For specific content, please refer to the [Feature Flags](/docs/self-hosting/adv
   try using `host.docker.internal` instead of `localhost`.
 </Callout>
 
+### `SSRF_ALLOW_PRIVATE_IP_ADDRESS`
+
+- Type: Optional
+- Description: Allow to connect private IP address. In a trusted environment, it can be set to true to turn off SSRF protection.
+- Default: `0`
+- Example: `1` or `0`
+
+### `SSRF_ALLOW_IP_ADDRESS_LIST`
+
+- Type: Optional
+- Description: Allow private IP address list, multiple IP addresses are separated by commas. Only when `SSRF_ALLOW_PRIVATE_IP_ADDRESS` is `0`, it takes effect.
+- Default: -
+- Example: `198.18.1.62,224.0.0.3`
+
 ## Plugin Service
 
 ### `PLUGINS_INDEX_URL`

package/docs/self-hosting/environment-variables/basic.zh-CN.mdx

@@ -88,6 +88,20 @@ LobeChat 在部署时提供了一些额外的配置项，你可以使用环境
   是走到自身容器的 `localhost`，此时请尝试用 `host.docker.internal` 替代 `localhost`
 </Callout>
 
+### `SSRF_ALLOW_PRIVATE_IP_ADDRESS`
+
+- 类型：可选
+- 描述：是否允许连接私有IP地址。在可信环境中可以设置为true来关闭SSRF防护。
+- 默认值：`0`
+- 示例：`1` or `0`
+
+### `SSRF_ALLOW_IP_ADDRESS_LIST`
+
+- 类型：可选
+- 描述：允许连接的私有IP地址列表，多个IP地址时使用逗号分隔。当 `SSRF_ALLOW_PRIVATE_IP_ADDRESS` 为 `0` 时才会生效。
+- 默认值：-
+- 示例：`198.18.1.62,224.0.0.3`
+
 ## 插件服务
 
 ### `PLUGINS_INDEX_URL`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobehub/chat",
-  "version": "1.29.1",
+  "version": "1.29.3",
   "description": "Lobe Chat - an open-source, high-performance chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Supports one-click free deployment of your private ChatGPT/LLM web application.",
   "keywords": [
     "framework",

package/src/app/(backend)/webapi/proxy/route.ts

@@ -1,6 +1,8 @@
 import { NextResponse } from 'next/server';
 import fetch from 'node-fetch';
-import { useAgent as ssrfAgent } from 'request-filtering-agent';
+import { RequestFilteringAgentOptions, useAgent as ssrfAgent } from 'request-filtering-agent';
+
+import { appEnv } from '@/config/app';
 
 /**
  * just for a proxy
@@ -9,7 +11,14 @@ export const POST = async (req: Request) => {
   const url = await req.text();
 
   try {
-    const res = await fetch(url, { agent: ssrfAgent(url) });
+    // https://www.npmjs.com/package/request-filtering-agent
+    const options: RequestFilteringAgentOptions = {
+      allowIPAddressList: appEnv.SSRF_ALLOW_IP_ADDRESS_LIST?.split(',') || [],
+      allowMetaIPAddress: appEnv.SSRF_ALLOW_PRIVATE_IP_ADDRESS,
+      allowPrivateIPAddress: appEnv.SSRF_ALLOW_PRIVATE_IP_ADDRESS,
+      denyIPAddressList: [],
+    };
+    const res = await fetch(url, { agent: ssrfAgent(url, options) });
 
     return new Response(await res.arrayBuffer(), { headers: { ...res.headers } });
   } catch (err) {

package/src/config/app.ts

@@ -46,6 +46,9 @@ export const getAppConfig = () => {
       CDN_USE_GLOBAL: z.boolean().optional(),
       CUSTOM_FONT_FAMILY: z.string().optional(),
       CUSTOM_FONT_URL: z.string().optional(),
+
+      SSRF_ALLOW_PRIVATE_IP_ADDRESS: z.boolean().optional(),
+      SSRF_ALLOW_IP_ADDRESS_LIST: z.string().optional(),
     },
     runtimeEnv: {
       NEXT_PUBLIC_BASE_PATH: process.env.NEXT_PUBLIC_BASE_PATH || '',
@@ -72,6 +75,9 @@ export const getAppConfig = () => {
       CUSTOM_FONT_FAMILY: process.env.CUSTOM_FONT_FAMILY,
       CUSTOM_FONT_URL: process.env.CUSTOM_FONT_URL,
       CDN_USE_GLOBAL: process.env.CDN_USE_GLOBAL === '1',
+
+      SSRF_ALLOW_PRIVATE_IP_ADDRESS: process.env.SSRF_ALLOW_PRIVATE_IP_ADDRESS === '1',
+      SSRF_ALLOW_IP_ADDRESS_LIST: process.env.SSRF_ALLOW_IP_ADDRESS_LIST,
     },
   });
 };

package/src/store/chat/slices/aiChat/actions/memory.ts

@@ -8,8 +8,6 @@ import { useUserStore } from '@/store/user';
 import { systemAgentSelectors } from '@/store/user/selectors';
 import { ChatMessage } from '@/types/message';
 
-import { getAgentConfig } from './helpers';
-
 export interface ChatMemoryAction {
   internal_summaryHistory: (messages: ChatMessage[]) => Promise<void>;
 }
@@ -24,9 +22,7 @@ export const chatMemory: StateCreator<
     const topicId = get().activeTopicId;
     if (messages.length <= 1 || !topicId) return;
 
-    const { model, provider } = getAgentConfig();
-
-    const historyCompressConfig = systemAgentSelectors.historyCompress(useUserStore.getState());
+    const { model, provider } = systemAgentSelectors.historyCompress(useUserStore.getState());
 
     let historySummary = '';
     await chatService.fetchPresetTaskResult({
@@ -34,12 +30,7 @@ export const chatMemory: StateCreator<
         historySummary = text;
       },
 
-      params: {
-        ...chainSummaryHistory(messages),
-        model: historyCompressConfig.model,
-        provider: historyCompressConfig.provider,
-        stream: false,
-      },
+      params: { ...chainSummaryHistory(messages), model, provider, stream: false },
     });
 
     await topicService.updateTopic(topicId, {