LibreChat/api/server/services/Files
Dustin Healy 4cec1a675f
🔒 feat: Add allowedAddresses Exemption to Speech (STT/TTS) and OCR Config Schemas (#14559)
* feat: add allowedAddresses exemption to speech (STT/TTS) and OCR config schemas

Add the existing allowedAddressesSchema as an optional field on sttSchema,
ttsSchema, and ocrSchema, reusing the schema already attached to endpoints,
mcpSettings, and actions so port scoping and normalization stay identical.

STT and TTS resolve a single provider by counting non-empty section keys, so
exclude the allowedAddresses key from that scan. Without the exclusion a
configured exemption list would be counted as a second provider and trip the
"Multiple providers are set" guard. The field is inert on its own: nothing
reads it for SSRF yet, and provider detection now ignores it.

* fix: preserve allowedAddresses through the OCR config loaders

loadOCRConfig rebuilt the ocr config with only apiKey, baseURL,
mistralModel, and strategy, dropping allowedAddresses before it reached
req.config.ocr. Pass it through in both the AppService loader
(packages/data-schemas/src/app/ocr.ts) and the duplicate at
packages/api/src/files/ocr.ts so the exemption survives config load.
2026-08-05 13:42:43 -04:00
..
Audio 🔒 feat: Add allowedAddresses Exemption to Speech (STT/TTS) and OCR Config Schemas (#14559) 2026-08-05 13:42:43 -04:00
Azure 🪣 refactor: Rate-Limit Token Routes and Cap Remote File Downloads (#13978) 2026-06-26 12:19:03 -04:00
Citations 🧩 feat: Redesign Tool Call UI with Contextual Icons, Smart Grouping, and Rich Output Rendering (#12163) 2026-03-25 12:31:39 -04:00
Code 🧱 fix: Enforce Agent Runtime File Trust Boundaries (#14577) 2026-08-02 14:18:28 -04:00
Firebase 🪣 refactor: Rate-Limit Token Routes and Cap Remote File Downloads (#13978) 2026-06-26 12:19:03 -04:00
images fix: bound peak memory of concurrent base64 attachment encoding (#14023) 2026-07-01 08:22:16 -04:00
Local 🪣 refactor: Rate-Limit Token Routes and Cap Remote File Downloads (#13978) 2026-06-26 12:19:03 -04:00
OpenAI 🧹 chore: Cleanup Logger and Utility Imports (#9935) 2025-10-01 23:30:47 -04:00
VectorDB 📎 feat: Upload as Text Support for Plaintext, STT, RAG, and Token Limits (#8868) 2025-08-27 03:44:39 -04:00
index.js 🏪 feat: Agent Marketplace 2025-08-13 16:24:18 -04:00
permissions.js 🧱 fix: Enforce Agent Runtime File Trust Boundaries (#14577) 2026-08-02 14:18:28 -04:00
permissions.spec.js 🧱 fix: Enforce Agent Runtime File Trust Boundaries (#14577) 2026-08-02 14:18:28 -04:00
process.integration.spec.js 🧹 fix: Clean Up Orphaned Agent File Stubs After Deletion (#12781) 2026-04-22 11:35:48 -07:00
process.js 🛟 fix: Keep File Uploads Alive With SSE Heartbeats (#14295) 2026-07-21 19:27:09 -04:00
process.spec.js 🛟 fix: Keep File Uploads Alive With SSE Heartbeats (#14295) 2026-07-21 19:27:09 -04:00
retention.js 🗃️ feat: Retain Agent Files During All-Data Retention (#13477) 2026-06-02 15:04:10 -04:00
strategies.js 🗄️ refactor: Honor All-Data Retention for Agent Files (#13424) 2026-05-30 22:32:22 -04:00