apiBase is a free-text setting (manifest.json:31, Service.qml:96) passed straight to both scripts with no validation — no scheme check, no host check, no length bound.
This is load-bearing in someone else's threat model, not just ours. The marketplace security review of 92161f0 used it as the reason model names must be treated as untrusted:
Panel.qml:501 and Panel.qml:720 render modelData.name — model names as returned by the Ollama API, whose base URL is a user-editable setting (Service.qml:96, manifest.json:31), so it is not necessarily a local trusted endpoint.
That reasoning is correct, and the mitigation applied (textFormat: Text.PlainText, trap #45) addresses the rendering half only. The trust boundary itself is still undeclared.
Also worth knowing: even the default is not automatically trustworthy. While ollama.service is stopped, any local process can bind 127.0.0.1:11434 and answer. Response bodies are now byte-capped for that reason, but nothing authenticates the peer.
Proposal — pick one and write it down.
- Constrain to loopback by default, with an explicit opt-in for a remote host; or
- Accept remote hosts but validate the scheme and host shape, reject anything that is not
http/https, and document plainly that pointing this at an untrusted server means trusting its strings.
Either is defensible. The current state — unvalidated, undocumented, and relied upon by an external reviewer's analysis — is the one that is not.
apiBaseis a free-text setting (manifest.json:31,Service.qml:96) passed straight to both scripts with no validation — no scheme check, no host check, no length bound.This is load-bearing in someone else's threat model, not just ours. The marketplace security review of
92161f0used it as the reason model names must be treated as untrusted:That reasoning is correct, and the mitigation applied (
textFormat: Text.PlainText, trap #45) addresses the rendering half only. The trust boundary itself is still undeclared.Also worth knowing: even the default is not automatically trustworthy. While
ollama.serviceis stopped, any local process can bind127.0.0.1:11434and answer. Response bodies are now byte-capped for that reason, but nothing authenticates the peer.Proposal — pick one and write it down.
http/https, and document plainly that pointing this at an untrusted server means trusting its strings.Either is defensible. The current state — unvalidated, undocumented, and relied upon by an external reviewer's analysis — is the one that is not.