WeKnora deployment source with the reviewed wiki identity, summary and recovery fixes

internal/application/service/parser_url_security.go

@@ -0,0 +1,33 @@
+package service
+
+import (
+	"fmt"
+	"strings"
+
+	secutils "github.com/Tencent/WeKnora/internal/utils"
+)
+
+var parserOutboundURLKeys = []string{
+	"mineru_endpoint",
+	"mineru_vlm_server_url",
+	"odl_hybrid_url",
+	"paddleocr_vl_endpoint",
+	"paddleocr_vl_cloud_base_url",
+}
+
+// validateParserEngineOverrideURLs validates every parser override that can
+// cause this process or the trusted DocReader service to make an outbound
+// request. Per-upload overrides are included because API callers can provide
+// the generic parser_engine_overrides map directly.
+func validateParserEngineOverrideURLs(overrides map[string]string) error {
+	for _, key := range parserOutboundURLKeys {
+		rawURL := strings.TrimSpace(overrides[key])
+		if rawURL == "" {
+			continue
+		}
+		if err := secutils.ValidateURLForSSRF(rawURL); err != nil {
+			return fmt.Errorf("%s failed SSRF validation: %w", key, err)
+		}
+	}
+	return nil
+}