From e18c6ee50250f0251f22c12e182f091466919a32 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=8E=8B=E5=BE=B7=E5=AE=87?= Date: Tue, 22 Sep 2026 15:12:06 +0800 Subject: [PATCH] =?UTF-8?q?=E4=BA=A7=E7=89=A9=E4=B8=8B=E8=BD=BD=E5=AE=A2?= =?UTF-8?q?=E6=88=B7=E7=AB=AF=E4=B8=8D=E5=86=8D=E8=B7=9F=E9=9A=8F=E8=B7=B3?= =?UTF-8?q?=E8=BD=AC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 产物地址来自 provider 响应，禁止 reqwest 自动跳转以防 SSRF - 需要跳转的地址会以非成功状态显式暴露，不再由服务端静默代发 --- server-rs/crates/platform-tripo/src/common/client.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/server-rs/crates/platform-tripo/src/common/client.rs b/server-rs/crates/platform-tripo/src/common/client.rs index 5e6bb20c8..ac51b805d 100644 --- a/server-rs/crates/platform-tripo/src/common/client.rs +++ b/server-rs/crates/platform-tripo/src/common/client.rs @@ -25,6 +25,9 @@ impl TripoProviderClient { // 这里只限制「多久没有进展」：连接用 connect_timeout，传输过程用 read_timeout。 .connect_timeout(settings.request_timeout) .read_timeout(settings.request_timeout) + // 产物地址由 provider 响应给出：不跟随跳转，避免被重定向到内网 / 云元数据地址。 + // 真的需要跳转的 CDN 会以非成功状态暴露出来，而不是被服务端静默代发请求。 + .redirect(reqwest::redirect::Policy::none()) .build() .map_err(|error| TripoError::Request { message: format!("failed to build artifact download client: {error}"),