jason/searxng
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[fix] plugin: ignore credentials in a user configured LLM server URL

Browse Source 
httpx derives an "Authorization: Basic" header from the userinfo of a
URL, so a user could make SearXNG send a header of their choosing to a
host of their choosing (e.g. to probe an internal service behind basic
auth).  A user preference carrying credentials is now ignored and the
administrator default is used instead; credentials in the configured
base_url are untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
jasonwitty
2026-08-05 23:05:24 -07:00
co-authored by Claude Opus 5
parent 19cc7a6f9f
commit ce400f993c
2 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
searx/plugins/ai_summary.py
+9 -1
View File
@@ -152,7 +152,15 @@ def _server_api_key(cfg: SettingsAISummary, server: str) -> str:
def _user_server(request: "SXNG_Request", cfg: SettingsAISummary) -> str:
"""The LLM server URL for this request: the user's ``ai_summary_server``
preference, or the administrator's default."""
return str(request.preferences.get_value("ai_summary_server") or "").strip() or cfg.base_url
server = str(request.preferences.get_value("ai_summary_server") or "").strip()
# Credentials are stripped from a user's server URL: httpx turns them into
# an Authorization header, and a user should not be able to make SearXNG
# send a header of their choosing to a host of their choosing. An
# administrator can still use credentials in the configured base_url (e.g.
# an LLM server behind basic auth).
if server and "@" in urlparse(server).netloc:
server = ""
return server or cfg.base_url
class SXNGPlugin(Plugin):