Repository navigation
embedding: validate embedding base url before building API provider - #1204
Merged
Merged
Conversation
NewAPIProvider stored the configured embedding endpoint verbatim, applying only strings.TrimRight(url, "/"). Any scheme/host was accepted: a non-http(s) scheme parsed but only failed at transport time, and any routable host was reachable — including the cloud-metadata range 169.254.169.254, which an attacker could reach by pointing a repo-local embedding.api_url at an internal address. A malformed or metadata-targeting URL could thus steer embedding traffic to a target it couldn't control. Add ValidateEmbeddingAPIURL and enforce it at both construction points: the .gortex.yaml embedding.api_url path (provider.go) and the GORTEX_EMBEDDINGS_URL flag/env path (serverstack/embedder.go). An invalid endpoint returns an error there instead of building the provider, so the embedder degrades to the default text search. The gate requires an http/https scheme and a host, and rejects link-local (cloud metadata) and unspecified addresses while allowing loopback (Ollama) and private/VPC hosts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
NewAPIProvider(internal/embedding/api.go) stored the configured embedding endpoint verbatim, applying onlystrings.TrimRight(url, "/").Any scheme/host was accepted:
file:///gopher:///unix://endpoints parsed but only failed at transport time, and any routable host was reachable — including the cloud-metadata range (e.g.169.254.169.254), which an attacker could reach by pointing a repo-localembedding.api_urlat an internal address. So a malformed or metadata-targeting URL could steer the daemon's embedding traffic to a target it couldn't control.Fix
Add
ValidateEmbeddingAPIURLand enforce it at both construction points:internal/embedding/provider.go— the.gortex.yamlembedding.api_urlpath (including repo-local config viaNewProviderFromConfig).internal/serverstack/embedder.go— theGORTEX_EMBEDDINGS_URLflag/env path.An invalid endpoint returns an error there instead of building the provider, so the embedder degrades to the default text search. The gate requires an
http/httpsscheme, a host, and rejects link-local (169.254.0.0/16, the cloud metadata range) and unspecified (0.0.0.0) addresses. Loopback (Ollama) and private/VPC hosts are allowed, since they aren't the unreachable-from-nowhere exfil targets link-local cloud metadata is.Note
This gates the scheme/routability of any configured endpoint. The broader supply-chain question of whether a repo-local
embedding.api_urlshould override global config without operator opt-in mirroringGORTEX_ALLOW_LOCAL_PROVIDERSis a separate concern.Test
TestValidateEmbeddingAPIURLcovers the ok/bad cases above. Existing embedding and serverstack suites pass unchanged.