mirror/nanobot
1
0
Fork 0
mirror of https://github.com/HKUDS/nanobot.git synced 2026-08-18 18:16:38 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(web): keep credential-bearing URLs away from the remote Jina reader

Browse Source
This commit is contained in:
shixi-li
2026-08-13 02:26:22 +09:00
committed by Xubin Ren
parent 498070d036
commit 31a71d6cd5
4 changed files with 235 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/configuration.md
+8
View File
@@ -1921,6 +1921,14 @@ Create a key at [serper.dev](https://serper.dev). You can also set `SERPER_API_K
nanobot by default uses [Jina Reader](https://jina.ai/reader/), a third-party API, to convert arbitrary pages into Markdown format for easy digestion by the LLM, with a local fallback based on [readability-lxml](https://github.com/buriy/python-readability) if the former fails.
> [!NOTE]
> Using the remote reader means the fetched URL itself is disclosed to the
> third-party service. URLs that visibly carry credentials (userinfo, signed-URL
> or token-style query parameters) are detected and fetched locally instead, but
> secrets embedded in a URL's *path* (for example bot-token or webhook-style
> URLs) cannot be reliably detected. Set `useJinaReader: false` if fetched URLs
> must never leave the machine.
If you want to always use the local conversion, you can force it using:
```json