server {

listen 80;

server_name localhost;

# 限制上传文件大小

client_max_body_size 20m;

location / {

root /usr/share/nginx/html;

index index.html index.htm;

# 支持 SPA 前端路由

try_files $uri $uri/ /index.html;

}

# 内部 Proxy 解决跨域问题

location /proxy/ {

# 必须配置 DNS 解析器才能动态解析 URL

resolver 8.8.8.8 8.8.4.4 ipv6=off valid=300s;

# 检查是否传递了 url 参数

if ($arg_url = "") {

return 400 "Missing url parameter";

}

# SSRF 防护逻辑：验证 URL

set $is_valid_url 0;

# 规则 1: 检查图片/视频后缀

if ($arg_url ~* \.(png|jpe?g|gif|webp|svg|bmp|avif|mp4)(\?.*)?$) {

set $is_valid_url 1;

}

# 规则 2: 检查白名单域名

if ($arg_url ~* ^https?://([^/]+\.)?(openai\.com|googleusercontent\.com|googleapis\.com|a4f\.co|muse-ai\.oss-cn-hangzhou\.aliyuncs\.com|gitee-ai\.su\.bcebos\.com|hf\.space)/) {

set $is_valid_url 1;

}

# 拦截不合规的请求

if ($is_valid_url = 0) {

return 403 "Forbidden: URL must be an image/video or from a whitelisted domain";

}

# 限制代理最大临时文件大小（20MB）防止大文件撑爆磁盘

proxy_max_temp_file_size 20m;

# 启用代理时的 SNI 支持

proxy_ssl_server_name on;

# 添加跨域 Headers

add_header 'Access-Control-Allow-Origin' '*' always;

add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS' always;

add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range' always;

add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range' always;

# 处理预检请求 (OPTIONS)

if ($request_method = 'OPTIONS') {

add_header 'Access-Control-Allow-Origin' '*';

add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';

add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';

add_header 'Access-Control-Max-Age' 1728000;

add_header 'Content-Type' 'text/plain; charset=utf-8';

add_header 'Content-Length' 0;

return 204;

}

# 转发代理请求

proxy_pass $arg_url;

}

}