Skip to content

feat: add ALLOW_PRIVATE_PROXY_HOSTS config for local proxy testing - #88

Merged
dwgx merged 3 commits into
dwgx:masterfrom
smeinecke:feat/allow-private-proxies
Apr 29, 2026
Merged

feat: add ALLOW_PRIVATE_PROXY_HOSTS config for local proxy testing#88
dwgx merged 3 commits into
dwgx:masterfrom
smeinecke:feat/allow-private-proxies

Conversation

@smeinecke

@smeinecke smeinecke commented Apr 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

改了什么 / What changed

Add opt-in flag to allow private/internal hosts (192.168.x.x, 10.x.x.x, localhost) in dashboard proxy tests. Default remains public-only for security. When enabled, testProxy() uses validateHostFormat() instead of assertPublicUrlHost() - still validates DNS/IP format but skips SSRF guards.

New validateHostFormat() helper in net-safety.js mirrors resolvePublicAddresses() structure without private-range rejection. Config wired through .env.example, setup.sh, and config

测试 / Testing

tested locally in dashboard

Checklist

  • 代码风格和现有文件一致 / Code style matches existing files
  • 没有引入 npm 依赖 / No new npm dependencies (project is zero-dep)
  • 涉及 LS binary 协议改动时 在 PR 描述里注明字段号来源 / If touching LS protocol, document field-number source in the PR description
  • 涉及 dashboard UI 用 App.confirm / App.prompt 不用浏览器原生 alert/confirm / Uses App.confirm / App.prompt, not native dialogs (if dashboard)

@smeinecke
feat: add ALLOW_PRIVATE_PROXY_HOSTS config for local proxy testing
0e5d29b 
Add opt-in flag to allow private/internal hosts (192.168.x.x, 10.x.x.x, localhost) in dashboard proxy tests. Default remains public-only for security. When enabled, testProxy() uses validateHostFormat() instead of assertPublicUrlHost() — still validates DNS/IP format but skips SSRF guards.

New validateHostFormat() helper in net-safety.js mirrors resolvePublicAddresses() structure without private-range rejection. Config wired through .env.example, setup.sh, and config
@smeinecke
refactor(dashboard): extract parseProxyUrl helper for proxy string pa…
84d54f4 
…rsing

Extract proxy URL parsing logic into standalone parseProxyUrl() function and export it. Reuse in buildBatchProxyBinding() and windsurfLoginBatch() instead of duplicating regex. Both call sites now use parseProxyUrl(proxy) instead of inline match + object construction.
@smeinecke
docs: add ALLOW_PRIVATE_PROXY_HOSTS to README env tables
d1e374c 
Document new config flag in both EN/CN READMEs. Explains opt-in for private/internal IPs in proxy tests, default remains public-only.
@dwgx
dwgx merged commit 543d996 into dwgx:master Apr 29, 2026
2 of 4 checks passed
@dwgx dwgx mentioned this pull request Apr 29, 2026
Merged
4 tasks
dwgx added a commit that referenced this pull request Apr 29, 2026
@dwgx
chore: 2.0.27 — i18n guard 收尾 + PR #88 #89 合并后
1526b40 
- check-i18n.js: bare identifier 不再误报缺失 key (errKey/errCode/etc)
- 补 action.revealKey 翻译（v2.0.26 之前就缺，hardcoded fallback 已去）
- 新增 footer.langToggleTo{En,Zh} 给 PR #89 引入的 toggleBtn.title 用，去掉硬编码 '切换到中文'
- 全部 i18n 检查 + 311/311 tests pass
@smeinecke
smeinecke deleted the feat/allow-private-proxies branch April 29, 2026 09:11
dwgx added a commit that referenced this pull request Apr 29, 2026
@dwgx
Merge pull request #90 from smeinecke/feat/add-account-proxy
59c5f71 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from #88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
huanchen pushed a commit to huanchen/WindsurfAPI that referenced this pull request May 3, 2026
@dwgx
Merge pull request dwgx#88 from smeinecke/feat/allow-private-proxies
ddf2af1 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase dwgx#90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
huanchen pushed a commit to huanchen/WindsurfAPI that referenced this pull request May 3, 2026
@dwgx
chore: 2.0.27 — i18n guard 收尾 + PR dwgx#88 dwgx#89 合并后
458f22f 
- check-i18n.js: bare identifier 不再误报缺失 key (errKey/errCode/etc)
- 补 action.revealKey 翻译（v2.0.26 之前就缺，hardcoded fallback 已去）
- 新增 footer.langToggleTo{En,Zh} 给 PR dwgx#89 引入的 toggleBtn.title 用，去掉硬编码 '切换到中文'
- 全部 i18n 检查 + 311/311 tests pass
huanchen pushed a commit to huanchen/WindsurfAPI that referenced this pull request May 3, 2026
@dwgx
Merge pull request dwgx#90 from smeinecke/feat/add-account-proxy
6e2e427 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from dwgx#88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
dwgx added a commit that referenced this pull request May 9, 2026
@dwgx
Merge pull request #88 from smeinecke/feat/allow-private-proxies
2ed28c9 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase #90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
dwgx added a commit that referenced this pull request May 9, 2026
@dwgx
chore: 2.0.27 — i18n guard 收尾 + PR #88 #89 合并后
d933a7b 
- check-i18n.js: bare identifier 不再误报缺失 key (errKey/errCode/etc)
- 补 action.revealKey 翻译（v2.0.26 之前就缺，hardcoded fallback 已去）
- 新增 footer.langToggleTo{En,Zh} 给 PR #89 引入的 toggleBtn.title 用，去掉硬编码 '切换到中文'
- 全部 i18n 检查 + 311/311 tests pass
dwgx added a commit that referenced this pull request May 9, 2026
@dwgx
Merge pull request #90 from smeinecke/feat/add-account-proxy
d01fbfd 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from #88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #88 from smeinecke/feat/allow-private-proxies
1414ec6 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase #90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
chore: 2.0.27 — i18n guard 收尾 + PR #88 #89 合并后
d7e0fe5 
- check-i18n.js: bare identifier 不再误报缺失 key (errKey/errCode/etc)
- 补 action.revealKey 翻译（v2.0.26 之前就缺，hardcoded fallback 已去）
- 新增 footer.langToggleTo{En,Zh} 给 PR #89 引入的 toggleBtn.title 用，去掉硬编码 '切换到中文'
- 全部 i18n 检查 + 311/311 tests pass
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #90 from smeinecke/feat/add-account-proxy
87f0d0f 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from #88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #88 from smeinecke/feat/allow-private-proxies
9572518 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase #90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
chore: 2.0.27 — i18n guard 收尾 + PR #88 #89 合并后
77738c5 
- check-i18n.js: bare identifier 不再误报缺失 key (errKey/errCode/etc)
- 补 action.revealKey 翻译（v2.0.26 之前就缺，hardcoded fallback 已去）
- 新增 footer.langToggleTo{En,Zh} 给 PR #89 引入的 toggleBtn.title 用，去掉硬编码 '切换到中文'
- 全部 i18n 检查 + 311/311 tests pass
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #90 from smeinecke/feat/add-account-proxy
6576a5f 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from #88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #88 from smeinecke/feat/allow-private-proxies
8d2bfc8 
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users.

Follow-ups for v2.0.27 (will track in repo, no action needed from you):
- Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected.
- Doc note: this switch should NOT be enabled on public-facing dashboards.
- Will rebase #90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
chore: 2.0.27 — i18n guard 收尾 + PR #88 #89 合并后
b933fb8 
- check-i18n.js: bare identifier 不再误报缺失 key (errKey/errCode/etc)
- 补 action.revealKey 翻译（v2.0.26 之前就缺，hardcoded fallback 已去）
- 新增 footer.langToggleTo{En,Zh} 给 PR #89 引入的 toggleBtn.title 用，去掉硬编码 '切换到中文'
- 全部 i18n 检查 + 311/311 tests pass
dwgx added a commit that referenced this pull request Jun 4, 2026
@dwgx
Merge pull request #90 from smeinecke/feat/add-account-proxy
ce9dfba 
Thanks @smeinecke for the rebase — duplicate config / setup / docs from #88 are cleaned up nicely. Merging.

I noticed the proxy validation ordering inside `addAccount` (account is still created before `body.proxy` is parsed/validated) wasn't moved in this revision — I'll fix that in a follow-up commit on master right after this merges, since you've already done the heavy lifting on the feature itself. No further action needed from you. Will also add the `test/account-add-proxy.test.js` suite there.

Appreciated 🙏
dwgx added a commit that referenced this pull request Jun 29, 2026
@dwgx
docs(thanks): add 6 missing merged-PR contributors
5dace50 
Backfill contributors who were merged but never added to the thanks
page, with weight tiers calibrated against existing entries:

- #64  baily-zhang (S)  — cascade transport canceled-session recovery
- #163 you922 (A)       — LS crash self-heal: exponential-backoff restart
- #204 lovivi (B+)      — glm-5.2 gpt_native tool dialect fix
- #90  smeinecke (B+)   — inline proxy on add-account form
- #88  smeinecke (B+)   — ALLOW_PRIVATE_PROXY_HOSTS opt-in for local proxy
- #89  smeinecke (B)    — login-flow i18n + error-code standardization

Synced src -> docs via sync:contributors. Also gitignore .workflow-results/
(local audit artifacts, not source). dashboard tests 17/17.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@smeinecke @dwgx