CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-10-21 09:32:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6

🗝️ fix: Protect Model Spec Instructions (#13125)
Some checks failed
Docker Dev Branch Images Build / build (Dockerfile, lc-dev, node) (push) Has been cancelled
Details
Docker Dev Branch Images Build / build (Dockerfile.multi, lc-dev-api, api-build) (push) Has been cancelled
Details
GitNexus Index / index (push) Has been cancelled
Details
GitNexus Index / post-index (push) Has been cancelled
Details
Docker Dev Images Build / build (Dockerfile, librechat-dev, node) (push) Has been cancelled
Details
Docker Dev Images Build / build (Dockerfile.multi, librechat-dev-api, api-build) (push) Has been cancelled
Details
Sync Locize Translations & Create Translation PR / Sync Translation Keys with Locize (push) Has been cancelled
Details
Sync Locize Translations & Create Translation PR / Create Translation PR on Version Published (push) Has been cancelled
Details

Browse source 
* fix: prevent instruction exposure

* fix: tighten model spec preset restoration

* refactor: type model spec preset handling
This commit is contained in:
Danny Avila 2026-05-14 10:07:23 -04:00 • committed by GitHub
parent b993d9fb28
commit ca8c212c0d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 668 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

37
api/server/routes/__tests__/config.spec.js
View file

@ -322,6 +322,43 @@ describe('GET /api/config', () => {
expect(response.body.webSearch).toEqual({ searchProvider: 'tavily' });
});
it('should strip private prompt fields from model spec presets', async () => {
mockGetAppConfig.mockResolvedValue({
...baseAppConfig,
modelSpecs: {
enforce: false,
prioritize: true,
list: [
{
name: 'guarded-spec',
label: 'Guarded Spec',
preset: {
endpoint: 'openAI',
model: 'gpt-4o',
promptPrefix: 'private prompt prefix',
instructions: 'private assistant instructions',
additional_instructions: 'private additional instructions',
system: 'private bedrock system',
context: 'private context',
examples: [{ input: { content: 'a' }, output: { content: 'b' } }],
greeting: 'Hello',
},
},
],
},
});
const app = createApp(mockUser);
const response = await request(app).get('/api/config');
expect(response.statusCode).toBe(200);
expect(response.body.modelSpecs.list[0].preset).toEqual({
endpoint: 'openAI',
model: 'gpt-4o',
greeting: 'Hello',
});
});
it('should include full interface config', async () => {
mockGetAppConfig.mockResolvedValue(baseAppConfig);
const app = createApp(mockUser);

9
api/server/routes/config.js
View file

@ -1,5 +1,10 @@
const express = require('express');
const { isEnabled, getBalanceConfig, getCloudFrontConfig } = require('@librechat/api');
const {
isEnabled,
getBalanceConfig,
getCloudFrontConfig,
sanitizeModelSpecs,
} = require('@librechat/api');
const { defaultSocialLogins } = require('librechat-data-provider');
const { logger, getTenantId, SystemCapabilities } = require('@librechat/data-schemas');
const { hasCapability } = require('~/server/middleware/roles/capabilities');
@ -181,7 +186,7 @@ router.get('/', async function (req, res) {
socialLogins: appConfig?.registration?.socialLogins ?? defaultSocialLogins,
interface: appConfig?.interfaceConfig,
turnstile: appConfig?.turnstileConfig,
modelSpecs: appConfig?.modelSpecs,
modelSpecs: sanitizeModelSpecs(appConfig?.modelSpecs),
balance: balanceConfig,
bundlerURL: process.env.SANDPACK_BUNDLER_URL,
staticBundlerURL: process.env.SANDPACK_STATIC_BUNDLER_URL,