THU-MAIC/OpenMAIC v1.0.2

OpenMAIC v1.0.2 — Security

on GitHub

A security release. Three advisories are published with this release, and two request paths behave differently — read the notes below before you upgrade.

Security

Three advisories are published with this release. Thank you to the reporters, who found and disclosed them privately.

• Cloud instance-metadata addresses bypassed the outbound URL guard. The metadata denylist was not applied before an IP literal was accepted, so an Alibaba Cloud metadata address (100.100.100.200) could be reached through /api/proxy-media and the URL guard. Metadata hostnames and addresses — including mapped and transition encodings — are now checked before the literal and local-network branches, in every environment and regardless of ALLOW_LOCAL_NETWORKS. GHSA-6xff-rgjg-v33f — reported by @lihua666a-cell
• DNS rebinding bypassed the SSRF guard on /api/proxy-media. The route validated a hostname and then let fetch() resolve it again at connect time, so a name whose answer changed between the two lookups could steer the socket to an internal address. The proxy now connects only to the addresses the guard validated, on every redirect hop, through a shared pinned dispatcher. GHSA-23xq-m3mm-3j49 — reported by @ry2811
• POST /api/classroom let any caller overwrite an existing classroom. A caller-chosen id was accepted and renamed over an existing classroom file. Ids are now server-generated and classroom files are created exclusively, with a bounded retry and a 409 on collision. GHSA-87m4-6c66-pc68 — reported by @ry2811

Also in this release: POST /api/generate/tts now inspects a 200 response before storing or billing it, rejecting HTML, JSON and other non-audio bodies and never following a URL embedded in a JSON envelope.

Before you upgrade

• Calling POST /api/classroom directly? It no longer honours a client-supplied stage.id. Read the classroom's id from the response.
• Reaching a model server or media over a Tailscale-style overlay (100.64.0.0/10)? The outbound URL guard now blocks CGNAT addresses by default, like private ranges; set ALLOW_LOCAL_NETWORKS=true to allow them. IANA reserved, documentation, multicast and broadcast ranges (240.0.0.0/4, 198.18.0.0/15, 192.0.2.0/24, 2001:db8::/32, …) are refused regardless of the flag, at both the URL and the connection layer.

Also in 1.0.2

GenUI and Interactive component referencing in playback, render queue preflight before an export compiles, generated media written through the asset pool under server-backed persistence, GLM-5.3 and GLM-5.3-Flash, and one JSON lifecycle event per render and preview transition on the render service — plus fixes for 300-second LLM timeouts, MTEF v3 formula conversion, portable ZIP retries, quiz answer-key resolution, sharp in standalone builds, and Windows material uploads.

See the full CHANGELOG for 1.0.2.