fix: malicious redirections & security risk

orasik · Dec 21, 2023 · 8d5fce9 · 8d5fce9
1 parent aeab8ed
commit 8d5fce9
Show file tree

Hide file tree

Showing 6 changed files with 6 additions and 9 deletions.
diff --git a/docs/src/containers/Banner/index.js b/docs/src/containers/Banner/index.js
@@ -71,6 +71,7 @@ export default function AnnoncementBanner() {
                 key={i}
                 href={social.href}
                 target="_blank"
+                rel="noopener"
               >
                 {social.icon}
               </a>

diff --git a/docs/src/containers/Footer/index.js b/docs/src/containers/Footer/index.js
@@ -109,6 +109,7 @@ export default function Footer() {
                         key={i}
                         href={social.href}
                         target="_blank"
+                        rel="noopener"
                       >
                         {social.icon}
                       </a>

diff --git a/extensions/inference-openai-extension/src/@types/global.d.ts b/extensions/inference-openai-extension/src/@types/global.d.ts
@@ -1,6 +1,5 @@
-import { Model } from "@janhq/core";
-
 declare const MODULE: string;
+declare const OPENAI_DOMAIN: string;
 
 declare interface EngineSettings {
   full_url?: string;

diff --git a/extensions/inference-openai-extension/src/helpers/sse.ts b/extensions/inference-openai-extension/src/helpers/sse.ts
@@ -1,5 +1,4 @@
 import { Observable } from "rxjs";
-import { EngineSettings, OpenAIModel } from "../@types/global";
 
 /**
  * Sends a request to the inference server to generate a response based on the recent messages.
@@ -16,7 +15,7 @@ export function requestInference(
 ): Observable<string> {
   return new Observable((subscriber) => {
     let model_id: string = model.id;
-    if (engine.full_url.includes("openai.azure.com")) {
+    if (engine.full_url.includes(OPENAI_DOMAIN)) {
       model_id = engine.full_url.split("/")[5];
     }
     const requestBody = JSON.stringify({

diff --git a/extensions/inference-openai-extension/src/index.ts b/extensions/inference-openai-extension/src/index.ts
@@ -22,7 +22,6 @@ import { InferenceExtension } from "@janhq/core";
 import { requestInference } from "./helpers/sse";
 import { ulid } from "ulid";
 import { join } from "path";
-import { EngineSettings, OpenAIModel } from "./@types/global";
 
 /**
  * A class that implements the InferenceExtension interface from the @janhq/core package.
@@ -108,6 +107,7 @@ export default class JanInferenceOpenAIExtension implements InferenceExtension {
    */
   async inference(data: MessageRequest): Promise<ThreadMessage> {
     const timestamp = Date.now();
+
     const message: ThreadMessage = {
       thread_id: data.threadId,
       created: timestamp,

diff --git a/extensions/inference-openai-extension/webpack.config.js b/extensions/inference-openai-extension/webpack.config.js
@@ -18,10 +18,7 @@ module.exports = {
   plugins: [
     new webpack.DefinePlugin({
       MODULE: JSON.stringify(`${packageJson.name}/${packageJson.module}`),
-      INFERENCE_URL: JSON.stringify(
-        process.env.INFERENCE_URL ||
-          "http://127.0.0.1:3928/inferences/llamacpp/chat_completion"
-      ),
+      OPENAI_DOMAIN: JSON.stringify("openai.azure.com"),
     }),
   ],
   output: {