chatflow-agent 0.3.2__tar.gz → 0.3.4__tar.gz

{chatflow_agent-0.3.2 → chatflow_agent-0.3.4}/.github/workflows/publish.yml

@@ -3,9 +3,6 @@ name: Publish to PyPI
 on:
   release:
     types: [published]
-  push:
-    tags:
-      - "v*"
 
 jobs:
   build-and-publish:

{chatflow_agent-0.3.2 → chatflow_agent-0.3.4}/CHANGELOG.md

@@ -14,6 +14,16 @@ Versioning / Versionado: [Semantic Versioning](https://semver.org/spec/v2.0.0.ht
 
 ## [Unreleased]
 
+## [0.3.4] - 2026-10-23
+
+### Security
+- **Stricter API key scoping for custom endpoints:** API keys read from environment variables are now sent only to the official endpoint of the provider they belong to. Configurations that use a custom `base_url` (proxies, gateways, other providers) must pass `api_key` explicitly; `api_key=""` sends no credential. `OpenAIEngine` and `AnthropicEngine` no longer follow HTTP redirects, even with an injected client configured to. See GHSA-mcgm-q29p-3984.
+
+## [0.3.3] - 2026-10-19
+
+### Security
+- **Strict Local Endpoint Hostname Validation:** `OpenAIEngine` now validates `base_url` structure, HTTP/HTTPS scheme, port range, and parsed hostname via `urllib.parse.urlsplit` when identifying local endpoints (`localhost`, `127.0.0.1`, `::1`, and local bind compatibility address `0.0.0.0`), replacing substring matching (Issue #74).
+
 ## [0.3.2] - 2026-09-29
 
 ### Security
@@ -69,6 +79,16 @@ If you are upgrading from v0.2.0:
 
 ## [Unreleased]
 
+## [0.3.4] - 2026-10-23
+
+### Seguridad
+- **Alcance más estricto de las API keys en endpoints personalizados:** las API keys leídas de variables de entorno ahora se envían solo al endpoint oficial del proveedor al que pertenecen. Las configuraciones con un `base_url` personalizado (proxies, gateways, otros proveedores) deben pasar `api_key` explícitamente; `api_key=""` no envía ninguna credencial. `OpenAIEngine` y `AnthropicEngine` ya no siguen redirects HTTP, aunque el cliente inyectado esté configurado para hacerlo. Ver GHSA-mcgm-q29p-3984.
+
+## [0.3.3] - 2026-10-19
+
+### Seguridad
+- **Validación Estricta de Hostname en Endpoints Locales:** `OpenAIEngine` ahora valida la estructura de `base_url`, el esquema HTTP/HTTPS, el rango de puerto y el hostname real mediante `urllib.parse.urlsplit` al identificar endpoints locales (`localhost`, `127.0.0.1`, `::1` y la dirección de compatibilidad local `0.0.0.0`), reemplazando la coincidencia por subcadenas (Issue #74).
+
 ## [0.3.2] - 2026-09-29
 
 ### Seguridad

{chatflow_agent-0.3.2 → chatflow_agent-0.3.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: chatflow-agent
-Version: 0.3.2
+Version: 0.3.4
 Summary: Lightweight, async multi-agent framework with native handoffs for Gemini, Gemma, Grok, OpenAI & Claude.
 Project-URL: Homepage, https://github.com/GustavoBaranda/chatflow-agent
 Project-URL: Source Code, https://github.com/GustavoBaranda/chatflow-agent

{chatflow_agent-0.3.2 → chatflow_agent-0.3.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "chatflow-agent"
-version = "0.3.2"
+version = "0.3.4"
 description = "Lightweight, async multi-agent framework with native handoffs for Gemini, Gemma, Grok, OpenAI & Claude."
 readme = "README.md"
 requires-python = ">=3.10"

{chatflow_agent-0.3.2 → chatflow_agent-0.3.4}/src/chatflow_agent/__init__.py

@@ -34,7 +34,7 @@ from chatflow_agent.types import (
 # Alias for semantic consistency
 BaseSessionContext = SessionContext
 
-__version__ = "0.3.2"
+__version__ = "0.3.4"
 __all__ = [
     "__version__",
     "Agent",

{chatflow_agent-0.3.2 → chatflow_agent-0.3.4}/src/chatflow_agent/core/engines/anthropic.py

@@ -3,14 +3,16 @@
 import asyncio
 import json
 import logging
-import os
 import random
 from typing import TYPE_CHECKING, Any
 
 import httpx
 
 from chatflow_agent.core.engines.base import BaseEngine, EngineTurnResult
-from chatflow_agent.core.engines.openai_compatible import _lowercase_schema_types
+from chatflow_agent.core.engines.openai_compatible import (
+    _lowercase_schema_types,
+    _resolve_api_key,
+)
 from chatflow_agent.exceptions import ProviderError
 from chatflow_agent.types import Message, Role, ToolCall
 
@@ -19,6 +21,8 @@ logger = logging.getLogger("chatflow_agent.engine.anthropic")
 if TYPE_CHECKING:
     from chatflow_agent.core.agent import Agent
 
+ANTHROPIC_BASE_URL = "https://api.anthropic.com/v1"
+
 
 class AnthropicEngine(BaseEngine):
     """Coordinates API requests with Anthropic Claude using Messages API over httpx."""
@@ -26,13 +30,20 @@ class AnthropicEngine(BaseEngine):
     def __init__(
         self,
         api_key: str | None = None,
-        base_url: str = "https://api.anthropic.com/v1",
+        base_url: str = ANTHROPIC_BASE_URL,
         anthropic_version: str = "2023-06-01",
         timeout: float = 60.0,
         http_client: httpx.AsyncClient | None = None,
     ) -> None:
-        self.api_key = api_key or os.environ.get("ANTHROPIC_API_KEY")
         self.base_url = base_url.rstrip("/")
+        # ANTHROPIC_API_KEY goes only to the official endpoint; proxies, gateways
+        # and local servers need an explicit api_key.
+        self.api_key = _resolve_api_key(
+            api_key,
+            self.base_url,
+            official_base_url=ANTHROPIC_BASE_URL,
+            env_key="ANTHROPIC_API_KEY",
+        )
         self.anthropic_version = anthropic_version
         self.timeout = timeout
         self.max_retries = 3
@@ -88,7 +99,9 @@ class AnthropicEngine(BaseEngine):
         history: list[Message],
     ) -> EngineTurnResult:
         """Call Anthropic Messages API asynchronously."""
-        if not self.api_key:
+        # api_key="" is an explicit choice to send no credential (e.g. an
+        # unauthenticated gateway); only a missing key is an error.
+        if self.api_key is None:
             raise ProviderError(
                 "Anthropic API key is not configured. Set ANTHROPIC_API_KEY environment variable."
             )
@@ -117,10 +130,11 @@ class AnthropicEngine(BaseEngine):
             payload["tools"] = anthropic_tools
 
         headers = {
-            "x-api-key": self.api_key,
             "anthropic-version": self.anthropic_version,
             "content-type": "application/json",
         }
+        if self.api_key:
+            headers["x-api-key"] = self.api_key
 
         url = f"{self.base_url}/messages"
 
@@ -128,7 +142,16 @@ class AnthropicEngine(BaseEngine):
         while True:
             client = self._external_client or httpx.AsyncClient(timeout=self.timeout)
             try:
-                resp = await client.post(url, json=payload, headers=headers)
+                # Never follow redirects, even on an injected client configured to:
+                # httpx keeps x-api-key on cross-origin redirects.
+                resp = await client.post(
+                    url, json=payload, headers=headers, follow_redirects=False
+                )
+                if 300 <= resp.status_code < 400:
+                    raise ProviderError(
+                        f"Anthropic API request was redirected (HTTP {resp.status_code}). "
+                        "Redirects are not followed; set base_url to the final endpoint."
+                    )
                 if resp.status_code in (429, 500, 502, 503, 504, 529):
                     if retries < self.max_retries:
                         retry_after_str = resp.headers.get("Retry-After")

{chatflow_agent-0.3.2 → chatflow_agent-0.3.4}/src/chatflow_agent/core/engines/factory.py

@@ -5,7 +5,11 @@ from typing import TYPE_CHECKING, cast
 from chatflow_agent.core.engines.anthropic import AnthropicEngine
 from chatflow_agent.core.engines.base import BaseEngine
 from chatflow_agent.core.engines.gemini import GeminiEngine
-from chatflow_agent.core.engines.openai_compatible import OpenAIEngine
+from chatflow_agent.core.engines.openai_compatible import (
+    PROVIDER_PRESETS,
+    OpenAIEngine,
+    _is_official_endpoint,
+)
 
 if TYPE_CHECKING:
     from chatflow_agent.core.agent import Agent
@@ -18,6 +22,20 @@ _GEMINI_PREFIXES = ("gemini-",)
 _OLLAMA_PREFIXES = ("gemma", "llama", "mistral", "qwen", "phi")
 
 
+def _provider_for_official_base_url(base_url: str) -> str:
+    """Return the preset whose official endpoint is exactly base_url, else "openai".
+
+    The provider decides which environment key OpenAIEngine may read, so a
+    base_url only selects a provider when it is that provider's official endpoint.
+    Any other URL keeps "openai", whose engine then requires an explicit api_key
+    (or applies the local-endpoint rule).
+    """
+    for name, preset in PROVIDER_PRESETS.items():
+        if _is_official_endpoint(base_url, preset["base_url"]):
+            return name
+    return "openai"
+
+
 def resolve_engine(agent: "Agent", default_engine: BaseEngine | None = None) -> BaseEngine:
     """Automatically resolve the appropriate LLM engine for an agent.
 
@@ -47,9 +65,15 @@ def resolve_engine(agent: "Agent", default_engine: BaseEngine | None = None) ->
     if provider in ("openai", "grok", "xai", "ollama", "gemma", "deepseek", "groq"):
         return OpenAIEngine(api_key=api_key, base_url=base_url, provider=provider)
 
-    # 3. Agent has custom base_url or api_key without provider
+    # 3. Agent has custom base_url or api_key without provider. An official
+    #    endpoint (e.g. DeepSeek's) selects its own provider and environment key;
+    #    OPENAI_API_KEY is never assumed for another host.
     if base_url:
-        return OpenAIEngine(api_key=api_key, base_url=base_url, provider="openai")
+        return OpenAIEngine(
+            api_key=api_key,
+            base_url=base_url,
+            provider=_provider_for_official_base_url(base_url),
+        )
 
     # 4. If Runner provided a default_engine (e.g. MockEngine or pre-configured engine), respect it!
     if default_engine is not None:

{chatflow_agent-0.3.2 → chatflow_agent-0.3.4}/src/chatflow_agent/core/engines/openai_compatible.py

@@ -10,6 +10,7 @@ import json
 import logging
 import os
 from typing import TYPE_CHECKING, Any
+from urllib.parse import urlsplit
 
 import httpx
 
@@ -22,6 +23,83 @@ logger = logging.getLogger("chatflow_agent.engine.openai")
 if TYPE_CHECKING:
     from chatflow_agent.core.agent import Agent
 
+_LOOPBACK_HOSTS: frozenset[str] = frozenset({"localhost", "127.0.0.1", "::1"})
+# Explicit compatibility exception for local dev servers bound to 0.0.0.0 (not a loopback address)
+_COMPAT_LOCAL_BIND_HOSTS: frozenset[str] = frozenset({"0.0.0.0"})
+
+
+def _is_local_base_url(base_url: str) -> bool:
+    """Return True only when base_url is a well-formed HTTP(S) URL targeting a local host."""
+    try:
+        parsed = urlsplit(base_url)
+        _ = parsed.port
+    except ValueError:
+        return False
+
+    if parsed.scheme.lower() not in ("http", "https") or not parsed.netloc:
+        return False
+    if parsed.username is not None or parsed.password is not None:
+        return False
+
+    hostname = (parsed.hostname or "").lower().rstrip(".")
+    return hostname in _LOOPBACK_HOSTS or hostname in _COMPAT_LOCAL_BIND_HOSTS
+
+
+def _is_official_endpoint(base_url: str, official_base_url: str) -> bool:
+    """Return True only when base_url is exactly the given official HTTPS endpoint.
+
+    Both URLs are parsed with httpx, the client that sends the request, and compared
+    by scheme, host, port and path. Look-alike hosts, userinfo, plain HTTP, a query,
+    a fragment or a different path never match.
+    """
+    try:
+        url = httpx.URL(base_url)
+        official = httpx.URL(official_base_url)
+    except (httpx.InvalidURL, TypeError, ValueError):
+        return False
+
+    if url.scheme != "https" or url.userinfo or url.query or url.fragment:
+        return False
+    return (
+        url.host == official.host
+        and (url.port or 443) == (official.port or 443)
+        and url.path.rstrip("/") == official.path.rstrip("/")
+    )
+
+
+def _redact_url(url: str) -> str:
+    """Return scheme, host, port and path only, so error messages never echo userinfo or a query."""
+    try:
+        parsed = httpx.URL(url)
+    except (httpx.InvalidURL, TypeError, ValueError):
+        return "<invalid URL>"
+    return f"{parsed.scheme}://{parsed.netloc.decode('ascii', 'replace')}{parsed.path}"
+
+
+def _resolve_api_key(
+    api_key: str | None,
+    base_url: str,
+    *,
+    official_base_url: str,
+    env_key: str,
+) -> str | None:
+    """Resolve the credential for a request to base_url.
+
+    An explicit api_key (including "") is always used as given. The environment
+    variable env_key is read only when base_url is the official endpoint of the
+    provider that issued that key. Any other endpoint requires an explicit api_key.
+    """
+    if api_key is not None:
+        return api_key
+    if _is_official_endpoint(base_url, official_base_url):
+        return os.environ.get(env_key)
+    raise ValueError(
+        f"A custom or unofficial base_url was provided ({_redact_url(base_url)!r}) without an explicit api_key. "
+        f"{env_key} is only sent to its official endpoint ({official_base_url}), so it is not used here. "
+        "Please provide api_key explicitly (or pass api_key='' if no authentication is required)."
+    )
+
+
 # Preset configurations for common OpenAI-compatible providers
 PROVIDER_PRESETS: dict[str, dict[str, str]] = {
     "openai": {
@@ -96,34 +174,24 @@ class OpenAIEngine(BaseEngine):
             or preset.get("base_url", "https://api.openai.com/v1")
         ).rstrip("/")
 
-        official_base_urls = {
-            p["base_url"].rstrip("/") for p in PROVIDER_PRESETS.values()
-        }
-        is_official = self.base_url in official_base_urls
-        is_local = any(
-            host in self.base_url for host in ("localhost", "127.0.0.1", "0.0.0.0")
-        )
-
         env_key_name = preset.get("env_key", "OPENAI_API_KEY")
 
         self.api_key: str | None
-        if api_key is not None:
-            self.api_key = api_key
-        elif is_local:
+        if api_key is None and _is_local_base_url(self.base_url):
             # For local services (Ollama, LM Studio, vLLM on localhost), do not leak global cloud API keys
             self.api_key = (
                 os.environ.get(env_key_name)
                 if self.provider in ("ollama", "gemma")
                 else None
             ) or "ollama"
-        elif is_official:
-            self.api_key = os.environ.get(env_key_name)
         else:
-            raise ValueError(
-                f"A custom or unofficial base_url was provided ({self.base_url!r}) without an explicit api_key. "
-                f"To prevent accidental leakage of your global {env_key_name} to untrusted endpoints, "
-                "fallback to environment API keys is disabled. "
-                "Please provide api_key explicitly (or pass api_key='' if no authentication is required)."
+            # The env key of the declared provider goes only to that provider's
+            # official endpoint, never to another preset's URL or a custom one.
+            self.api_key = _resolve_api_key(
+                api_key,
+                self.base_url,
+                official_base_url=preset.get("base_url", "https://api.openai.com/v1"),
+                env_key=env_key_name,
             )
         self.timeout = timeout
         self.max_retries = 3
@@ -220,7 +288,16 @@ class OpenAIEngine(BaseEngine):
         while True:
             client = self._external_client or httpx.AsyncClient(timeout=self.timeout)
             try:
-                resp = await client.post(url, json=payload, headers=headers)
+                # Never follow redirects, even on an injected client configured to:
+                # the credential must not be replayed to whatever host a 3xx names.
+                resp = await client.post(
+                    url, json=payload, headers=headers, follow_redirects=False
+                )
+                if 300 <= resp.status_code < 400:
+                    raise ProviderError(
+                        f"{self.provider.upper()} API request was redirected (HTTP {resp.status_code}). "
+                        "Redirects are not followed; set base_url to the final endpoint."
+                    )
                 if resp.status_code in (429, 500, 502, 503, 504):
                     if retries < self.max_retries:
                         retry_after_str = resp.headers.get("Retry-After")

chatflow_agent-0.3.4/tests/test_engine_credentials.py

@@ -0,0 +1,384 @@
+"""Credential scoping for OpenAIEngine and AnthropicEngine.
+
+An API key read from the environment may only be sent to the official endpoint of
+the provider that issued it. All keys below are fictitious and every request is
+served by ``httpx.MockTransport``; nothing leaves the process.
+"""
+
+import logging
+import os
+from collections.abc import Callable
+
+import httpx
+import pytest
+
+from chatflow_agent.core.agent import Agent
+from chatflow_agent.core.engines import (
+    AnthropicEngine,
+    OpenAIEngine,
+    resolve_engine,
+)
+from chatflow_agent.core.engines.base import BaseEngine
+from chatflow_agent.exceptions import ProviderError
+from chatflow_agent.types import Message, Role
+
+FAKE_KEYS = {
+    "OPENAI_API_KEY": "sk-FAKE-openai-0000",
+    "XAI_API_KEY": "sk-FAKE-xai-0000",
+    "DEEPSEEK_API_KEY": "sk-FAKE-deepseek-0000",
+    "GROQ_API_KEY": "sk-FAKE-groq-0000",
+    "ANTHROPIC_API_KEY": "sk-FAKE-anthropic-0000",
+    "OLLAMA_API_KEY": "sk-FAKE-ollama-0000",
+}
+EXPLICIT_KEY = "sk-FAKE-explicit-proxy-0000"
+PROXY_URL = "https://proxy.example.com/v1"
+
+# Both engines accept this body: OpenAI reads "choices", Anthropic reads "content".
+_OK_BODY: dict[str, list[object]] = {"choices": [], "content": []}
+
+
+@pytest.fixture(autouse=True)
+def fake_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Replace every real *_API_KEY / *_BASE_URL with fictitious keys."""
+    for name in list(os.environ):
+        if name.endswith(("_API_KEY", "_BASE_URL")):
+            monkeypatch.delenv(name)
+    for name, value in FAKE_KEYS.items():
+        monkeypatch.setenv(name, value)
+
+
+def _agent(**kwargs: str) -> Agent:
+    kwargs.setdefault("model", "gpt-4o-mini")
+    return Agent(name="Credentials", instructions="Reply.", **kwargs)  # type: ignore[arg-type]
+
+
+def _install(
+    engine: BaseEngine,
+    handler: Callable[[httpx.Request], httpx.Response],
+    *,
+    follow_redirects: bool = False,
+) -> None:
+    engine._external_client = httpx.AsyncClient(  # type: ignore[attr-defined]
+        transport=httpx.MockTransport(handler), follow_redirects=follow_redirects
+    )
+
+
+async def _send_one(engine: BaseEngine, agent: Agent) -> httpx.Request:
+    seen: list[httpx.Request] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.append(request)
+        return httpx.Response(200, json=_OK_BODY)
+
+    _install(engine, handler)
+    await engine.generate_turn_async(agent, [Message(role=Role.USER, content="hi")])
+    assert len(seen) == 1
+    return seen[0]
+
+
+def _credential(request: httpx.Request) -> str | None:
+    if "x-api-key" in request.headers:
+        return request.headers["x-api-key"]
+    auth = request.headers.get("authorization")
+    return auth.removeprefix("Bearer ") if auth else None
+
+
+# --- Configurations that send a key: it must be the right key for the right host.
+
+@pytest.mark.parametrize(
+    ("agent_kwargs", "expected_engine", "expected_host", "expected_key"),
+    [
+        ({"provider": "openai"}, OpenAIEngine, "api.openai.com", FAKE_KEYS["OPENAI_API_KEY"]),
+        ({"provider": "deepseek"}, OpenAIEngine, "api.deepseek.com", FAKE_KEYS["DEEPSEEK_API_KEY"]),
+        (
+            {"model": "deepseek-chat", "base_url": "https://api.deepseek.com/v1"},
+            OpenAIEngine, "api.deepseek.com", FAKE_KEYS["DEEPSEEK_API_KEY"],
+        ),
+        (
+            {"model": "grok-2", "base_url": "https://api.x.ai/v1"},
+            OpenAIEngine, "api.x.ai", FAKE_KEYS["XAI_API_KEY"],
+        ),
+        (
+            {"model": "llama-3.3-70b-versatile", "base_url": "https://api.groq.com/openai/v1/"},
+            OpenAIEngine, "api.groq.com", FAKE_KEYS["GROQ_API_KEY"],
+        ),
+        (
+            {"model": "gpt-4o", "base_url": "https://API.OPENAI.COM:443/v1/"},
+            OpenAIEngine, "api.openai.com", FAKE_KEYS["OPENAI_API_KEY"],
+        ),
+        ({"model": "claude-3-5-sonnet"}, AnthropicEngine, "api.anthropic.com", FAKE_KEYS["ANTHROPIC_API_KEY"]),
+        (
+            {"model": "claude-3-5-sonnet", "provider": "anthropic", "base_url": "https://api.anthropic.com/v1/"},
+            AnthropicEngine, "api.anthropic.com", FAKE_KEYS["ANTHROPIC_API_KEY"],
+        ),
+        (
+            {"model": "gemma2:9b", "provider": "ollama", "base_url": "http://localhost:11434/v1"},
+            OpenAIEngine, "localhost", FAKE_KEYS["OLLAMA_API_KEY"],
+        ),
+        # Explicit keys keep working with any endpoint (legitimate proxies and gateways).
+        ({"base_url": PROXY_URL, "api_key": EXPLICIT_KEY}, OpenAIEngine, "proxy.example.com", EXPLICIT_KEY),
+        (
+            {"provider": "openai", "base_url": "https://api.groq.com/openai/v1", "api_key": EXPLICIT_KEY},
+            OpenAIEngine, "api.groq.com", EXPLICIT_KEY,
+        ),
+        (
+            {"model": "claude-3-5-sonnet", "provider": "anthropic", "base_url": PROXY_URL, "api_key": EXPLICIT_KEY},
+            AnthropicEngine, "proxy.example.com", EXPLICIT_KEY,
+        ),
+    ],
+)
+async def test_environment_key_reaches_only_its_own_provider(
+    agent_kwargs: dict[str, str],
+    expected_engine: type[BaseEngine],
+    expected_host: str,
+    expected_key: str,
+) -> None:
+    agent = _agent(**agent_kwargs)
+    engine = resolve_engine(agent)
+    assert isinstance(engine, expected_engine)
+
+    request = await _send_one(engine, agent)
+
+    assert request.url.host == expected_host
+    assert _credential(request) == expected_key
+
+
+# --- Configurations that would send a key to a host that did not issue it.
+
+@pytest.mark.parametrize(
+    "agent_kwargs",
+    [
+        {"provider": "openai", "base_url": "https://api.groq.com/openai/v1"},
+        {"provider": "grok", "base_url": "https://api.openai.com/v1"},
+        {"provider": "deepseek", "base_url": "https://api.x.ai/v1"},
+        {"provider": "openai", "base_url": PROXY_URL},
+        {"provider": "anthropic", "base_url": PROXY_URL},
+        {"provider": "claude", "base_url": "http://10.0.0.5:8080"},
+        {"provider": "anthropic", "base_url": "http://localhost:4000/v1"},
+        {"provider": "anthropic", "base_url": "https://api.openai.com/v1"},
+        {"model": "claude-3-5-sonnet", "base_url": PROXY_URL},
+        {"model": "gpt-4o", "base_url": "https://api.anthropic.com/v1"},
+    ],
+)
+def test_environment_key_is_not_sent_to_other_endpoints(agent_kwargs: dict[str, str]) -> None:
+    with pytest.raises(ValueError, match="A custom or unofficial base_url was provided") as exc_info:
+        resolve_engine(_agent(**agent_kwargs))
+    _assert_no_fake_key(str(exc_info.value))
+
+
+@pytest.mark.parametrize(
+    ("official", "build"),
+    [
+        ("https://api.openai.com/v1", lambda url: OpenAIEngine(provider="openai", base_url=url)),
+        ("https://api.x.ai/v1", lambda url: OpenAIEngine(provider="grok", base_url=url)),
+        ("https://api.anthropic.com/v1", lambda url: AnthropicEngine(base_url=url)),
+    ],
+)
+@pytest.mark.parametrize(
+    "mutate",
+    [
+        lambda u: u.replace("https://", "http://"),
+        lambda u: u.replace("/v1", ".evil.example/v1"),
+        lambda u: u.replace("https://", "https://user:hunter2@"),
+        lambda u: u.replace("/v1", "@evil.example/v1"),
+        lambda u: u.replace("/v1", ":8443/v1"),
+        lambda u: u + "/extra",
+        lambda u: u.replace("/v1", "/v2"),
+        lambda u: u + "?redirect=evil.example",
+        lambda u: u + "#fragment",
+        lambda u: "https://evil.example/" + u,
+    ],
+)
+def test_lookalike_official_urls_never_get_environment_key(
+    official: str,
+    build: Callable[[str], BaseEngine],
+    mutate: Callable[[str], str],
+) -> None:
+    with pytest.raises(ValueError, match="A custom or unofficial base_url was provided") as exc_info:
+        build(mutate(official))
+    message = str(exc_info.value)
+    _assert_no_fake_key(message)
+    assert "hunter2" not in message
+
+
+def test_resolve_engine_does_not_infer_provider_from_lookalike_host() -> None:
+    with pytest.raises(ValueError, match="A custom or unofficial base_url was provided"):
+        resolve_engine(_agent(model="deepseek-chat", base_url="https://api.deepseek.com.evil.example/v1"))
+
+
+# --- *_BASE_URL environment variables follow the same rule.
+
+@pytest.mark.parametrize(
+    ("env_var", "url", "provider"),
+    [
+        ("OPENAI_BASE_URL", "https://api.x.ai/v1", "openai"),
+        ("OPENAI_BASE_URL", PROXY_URL, "openai"),
+        ("GROK_BASE_URL", "https://api.openai.com/v1", "grok"),
+        ("XAI_BASE_URL", "https://api.openai.com/v1", "xai"),
+        ("DEEPSEEK_BASE_URL", "https://api.groq.com/openai/v1", "deepseek"),
+    ],
+)
+def test_base_url_env_var_does_not_unlock_another_providers_key(
+    monkeypatch: pytest.MonkeyPatch, env_var: str, url: str, provider: str
+) -> None:
+    monkeypatch.setenv(env_var, url)
+    with pytest.raises(ValueError, match="A custom or unofficial base_url was provided"):
+        OpenAIEngine(provider=provider)
+
+
+async def test_base_url_env_var_pointing_to_own_official_endpoint_is_accepted(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("DEEPSEEK_BASE_URL", "https://api.deepseek.com/v1/")
+    engine = OpenAIEngine(provider="deepseek")
+    request = await _send_one(engine, _agent(model="deepseek-chat"))
+    assert request.url.host == "api.deepseek.com"
+    assert _credential(request) == FAKE_KEYS["DEEPSEEK_API_KEY"]
+
+
+# --- Explicit empty key: no credential at all, even with keys in the environment.
+
+@pytest.mark.parametrize(
+    "build",
+    [
+        lambda: OpenAIEngine(base_url=PROXY_URL, api_key=""),
+        lambda: AnthropicEngine(base_url=PROXY_URL, api_key=""),
+        lambda: AnthropicEngine(api_key=""),
+        lambda: resolve_engine(_agent(base_url=PROXY_URL, api_key="")),
+    ],
+)
+async def test_explicit_empty_api_key_sends_no_credential(build: Callable[[], BaseEngine]) -> None:
+    engine = build()
+    request = await _send_one(engine, _agent(model="claude-3-5-sonnet"))
+    assert "authorization" not in request.headers
+    assert "x-api-key" not in request.headers
+
+
+@pytest.mark.parametrize("env_has_key", [True, False], ids=["env-key", "no-env-key"])
+@pytest.mark.parametrize(
+    ("build", "env_var", "header"),
+    [
+        (lambda key: OpenAIEngine(provider="openai", api_key=key), "OPENAI_API_KEY", "authorization"),
+        (lambda key: AnthropicEngine(api_key=key), "ANTHROPIC_API_KEY", "x-api-key"),
+    ],
+    ids=["openai", "anthropic"],
+)
+async def test_none_reads_environment_but_empty_string_never_does(
+    monkeypatch: pytest.MonkeyPatch,
+    build: Callable[[str | None], BaseEngine],
+    env_var: str,
+    header: str,
+    env_has_key: bool,
+) -> None:
+    """On the official endpoint, None falls back to the env key; "" never does and sends no header."""
+    if not env_has_key:
+        monkeypatch.delenv(env_var)
+
+    request = await _send_one(build(""), _agent())
+    assert header not in request.headers
+
+    engine = build(None)
+    if env_has_key:
+        request = await _send_one(engine, _agent())
+        assert _credential(request) == FAKE_KEYS[env_var]
+    elif isinstance(engine, AnthropicEngine):
+        with pytest.raises(ProviderError, match="not configured"):
+            await engine.generate_turn_async(_agent(), [Message(role=Role.USER, content="hi")])
+    else:
+        request = await _send_one(engine, _agent())
+        assert header not in request.headers
+
+
+async def test_anthropic_without_any_key_still_reports_missing_configuration(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.delenv("ANTHROPIC_API_KEY")
+    engine = AnthropicEngine()
+    with pytest.raises(ProviderError, match="ANTHROPIC_API_KEY"):
+        await engine.generate_turn_async(_agent(), [Message(role=Role.USER, content="hi")])
+
+
+# --- Redirects: never followed, so no credential is replayed to another origin.
+
+@pytest.mark.parametrize(
+    "location",
+    ["https://evil.example/collect", "/v1/moved", "https://{host}/v1/moved"],
+    ids=["cross-origin", "same-origin-relative", "same-origin-absolute"],
+)
+@pytest.mark.parametrize("status", [301, 302, 303, 307, 308])
+@pytest.mark.parametrize(
+    "build",
+    [
+        lambda: OpenAIEngine(provider="openai"),
+        lambda: AnthropicEngine(),
+        lambda: OpenAIEngine(base_url=PROXY_URL, api_key=EXPLICIT_KEY),
+        lambda: AnthropicEngine(base_url=PROXY_URL, api_key=EXPLICIT_KEY),
+    ],
+)
+async def test_redirects_are_not_followed_even_by_injected_clients(
+    build: Callable[[], BaseEngine], status: int, location: str
+) -> None:
+    engine = build()
+    seen: list[httpx.Request] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.append(request)
+        if request.url.host == "evil.example" or request.url.path.endswith("/moved"):
+            return httpx.Response(200, json=_OK_BODY)
+        return httpx.Response(
+            status, headers={"Location": location.format(host=request.url.host)}
+        )
+
+    _install(engine, handler, follow_redirects=True)
+
+    with pytest.raises(ProviderError, match="redirected") as exc_info:
+        await engine.generate_turn_async(_agent(), [Message(role=Role.USER, content="hi")])
+
+    assert [r.url.host for r in seen] == [httpx.URL(engine.base_url).host]  # type: ignore[attr-defined]
+    _assert_no_fake_key(str(exc_info.value))
+
+
+# --- Errors and logs never contain a key.
+
+def _assert_no_fake_key(text: str) -> None:
+    for secret in (*FAKE_KEYS.values(), EXPLICIT_KEY):
+        assert secret not in text
+
+
+@pytest.mark.parametrize(
+    "build",
+    [lambda: OpenAIEngine(provider="openai"), lambda: AnthropicEngine()],
+)
+@pytest.mark.parametrize(
+    "respond",
+    [
+        lambda request: httpx.Response(401, json={"error": "invalid key"}),
+        lambda request: httpx.Response(503, json={"error": "unavailable"}),
+        lambda request: httpx.Response(307, headers={"Location": "https://evil.example/"}),
+        lambda request: (_ for _ in ()).throw(httpx.ConnectError("refused", request=request)),
+        lambda request: (_ for _ in ()).throw(httpx.ReadTimeout("timed out", request=request)),
+    ],
+)
+async def test_errors_and_logs_never_contain_api_keys(
+    caplog: pytest.LogCaptureFixture,
+    build: Callable[[], BaseEngine],
+    respond: Callable[[httpx.Request], httpx.Response],
+) -> None:
+    engine = build()
+    engine.base_delay = 0.0  # type: ignore[attr-defined]
+    engine.max_delay = 0.0  # type: ignore[attr-defined]
+    _install(engine, respond)
+
+    with caplog.at_level(logging.DEBUG), pytest.raises(ProviderError) as exc_info:
+        await engine.generate_turn_async(_agent(), [Message(role=Role.USER, content="hi")])
+
+    chain: list[BaseException] = []
+    err: BaseException | None = exc_info.value
+    while err is not None:
+        chain.append(err)
+        err = err.__cause__ or err.__context__
+    _assert_no_fake_key(caplog.text)
+    for item in chain:
+        _assert_no_fake_key(str(item))
+        _assert_no_fake_key(repr(item))
+    _assert_no_fake_key(repr(engine))

{chatflow_agent-0.3.2 → chatflow_agent-0.3.4}/tests/test_multi_engine.py

@@ -279,6 +279,102 @@ def test_custom_base_url_rejects_fallback_to_global_api_key(monkeypatch: pytest.
     assert engine_official.api_key == "sk-secret-prod-key-12345"
 
 
+@pytest.mark.parametrize(
+    "spoofed_or_malformed_url",
+    [
+        "https://localhost.untrusted.example.com/v1",
+        "https://sub.localhost.example.com/v1",
+        "https://my-localhost.example.com/v1",
+        "https://untrusted.example.com/localhost/v1",
+        "https://untrusted.example.com/v1?origin=localhost",
+        "https://localhost@untrusted.example.com/v1",
+        "http://user:pass@localhost:11434/v1",
+        "https://127.0.0.1.untrusted.example.com/v1",
+        "https://untrusted.example.com/127.0.0.1/v1",
+        "https://0.0.0.0.untrusted.example.com/v1",
+        "ftp://localhost:11434/v1",
+        "localhost:11434/v1",
+        "http:///localhost/v1",
+        "http://[::1:11434/v1",
+        "http://localhost:badport/v1",
+        "http://localhost:99999/v1",
+    ],
+)
+def test_spoofed_or_malformed_local_base_url_is_rejected(
+    monkeypatch: pytest.MonkeyPatch, spoofed_or_malformed_url: str
+) -> None:
+    """External or malformed URLs containing local substrings must not bypass SEC-07 or leak env keys."""
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-secret-prod-key")
+    monkeypatch.setenv("OLLAMA_API_KEY", "ollama-secret-token")
+
+    for provider in ("openai", "ollama", "gemma"):
+        with pytest.raises(ValueError, match="A custom or unofficial base_url was provided"):
+            OpenAIEngine(provider=provider, base_url=spoofed_or_malformed_url)
+
+
+@pytest.mark.parametrize(
+    "spoofed_url",
+    [
+        "https://localhost.untrusted.example.com/v1",
+        "https://untrusted.example.com/localhost/v1",
+        "https://127.0.0.1.untrusted.example.com/v1",
+        "https://0.0.0.0.untrusted.example.com/v1",
+        "https://localhost@untrusted.example.com/v1",
+    ],
+)
+def test_spoofed_local_base_url_from_env_vars_is_rejected(
+    monkeypatch: pytest.MonkeyPatch, spoofed_url: str
+) -> None:
+    """Spoofed URLs provided via OPENAI_BASE_URL or OLLAMA_BASE_URL without explicit base_url must be rejected."""
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-secret-prod-key")
+    monkeypatch.setenv("OLLAMA_API_KEY", "ollama-secret-token")
+
+    monkeypatch.setenv("OPENAI_BASE_URL", spoofed_url)
+    with pytest.raises(ValueError, match="A custom or unofficial base_url was provided"):
+        OpenAIEngine(provider="openai")
+
+    monkeypatch.setenv("OLLAMA_BASE_URL", spoofed_url)
+    with pytest.raises(ValueError, match="A custom or unofficial base_url was provided"):
+        OpenAIEngine(provider="ollama")
+
+
+@pytest.mark.parametrize(
+    "local_url",
+    [
+        "http://localhost:11434/v1",
+        "http://LOCALHOST:11434/v1/",
+        "http://localhost.:11434/v1",
+        "https://localhost:8443/v1",
+        "http://127.0.0.1:11434/v1",
+        "http://[::1]:11434/v1",
+        "http://0.0.0.0:8000/v1",
+    ],
+)
+def test_valid_local_base_urls_are_accepted_and_protect_cloud_keys(
+    monkeypatch: pytest.MonkeyPatch, local_url: str
+) -> None:
+    """Valid loopback (localhost, 127.0.0.1, ::1) and compatibility 0.0.0.0 URLs work without leaking cloud keys."""
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-secret-prod-key")
+    monkeypatch.delenv("OLLAMA_API_KEY", raising=False)
+
+    # provider='openai' pointed at local server must NOT leak OPENAI_API_KEY
+    engine_openai = OpenAIEngine(provider="openai", base_url=local_url)
+    assert engine_openai.api_key == "ollama"
+
+    # provider='ollama' / 'gemma' without OLLAMA_API_KEY defaults to 'ollama'
+    engine_ollama = OpenAIEngine(provider="ollama", base_url=local_url)
+    assert engine_ollama.api_key == "ollama"
+    engine_gemma = OpenAIEngine(provider="gemma", base_url=local_url)
+    assert engine_gemma.api_key == "ollama"
+
+    # provider='ollama' / 'gemma' with OLLAMA_API_KEY honors it on genuine local URLs
+    monkeypatch.setenv("OLLAMA_API_KEY", "local-ollama-token")
+    engine_ollama_auth = OpenAIEngine(provider="ollama", base_url=local_url)
+    assert engine_ollama_auth.api_key == "local-ollama-token"
+    engine_gemma_auth = OpenAIEngine(provider="gemma", base_url=local_url)
+    assert engine_gemma_auth.api_key == "local-ollama-token"
+
+
 @pytest.mark.asyncio
 async def test_anthropic_retry_on_529_overloaded() -> None:
     """Test AnthropicEngine retries on HTTP 529 Overloaded and succeeds."""