private static int hex_to_bin(final char[] arr, final int offset, final int length) {
        int value = 0;
        int ai, count;

        count = 0;
        for (ai = offset; ai < arr.length && count < length; ai++) {
            value <<= 4;
            switch (arr[ai]) {
            case '0':
            case '1':
            case '2':
            case '3':
            case '4':
            case '5':

     */
    public static int hex_to_bin(final char[] arr, final int offset, final int length) {
        int value = 0;
        int ai, count;

        count = 0;
        for (ai = offset; ai < arr.length && count < length; ai++) {
            value <<= 4;
            switch (arr[ai]) {
            case '0':
            case '1':
            case '2':
            case '3':
            case '4':
            case '5':

- 应用在本地（如 `localhost`）或内网中运行
- 且应用没有任何认证，假定来自同一网络的请求都可信。

## 攻击示例 { #example-attack }

假设你构建了一个本地运行的 AI 代理。

它提供了一个 API，地址为

```
http://localhost:8000/v1/agents/multivac
```

另有一个前端，地址为

```
http://localhost:8000
```

/// tip | 提示

注意它们的主机相同。

///

之后，你可以通过前端让该 AI 代理替你执行操作。

由于它在本地运行、而非暴露在开放的互联网，你决定不配置任何认证，只信任对本地网络的访问。

于是，你的某位用户安装并在本地运行了它。

然后他（她）可能会打开一个恶意网站，例如

  stars: 34997
  owner_login: mouredev
  owner_html_url: https://github.com/mouredev
- name: serve
  html_url: https://github.com/jina-ai/serve
  stars: 21857
  owner_login: jina-ai
  owner_html_url: https://github.com/jina-ai
- name: HivisionIDPhotos
  html_url: https://github.com/Zeyi-Lin/HivisionIDPhotos
  stars: 20868
  owner_login: Zeyi-Lin
  owner_html_url: https://github.com/Zeyi-Lin

### Closing Automated and AI PRs

If we see PRs that seem AI generated or automated in similar ways, we'll flag them and close them.

The same applies to comments and descriptions, please don't copy paste the content generated by an LLM.

### Human Effort Denial of Service

                model_not_found: 'The AI model was not found. Please contact the administrator.',
                invalid_response: 'Received an invalid response from the AI service. Please try again.',
                connection_error: 'Unable to connect to the AI service. Please check the network connection.',
                unknown: 'An error occurred. Please try again.'
            }
        }
    };

  #   title: Learn to build high-quality web apps with best practices
  #   img: https://fastapi.tiangolo.com/img/sponsors/testdriven.svg
  - url: https://www.testmu.ai/?utm_source=fastapi&utm_medium=partner&utm_campaign=sponsor&utm_term=opensource&utm_content=webpage
    title: TestMu AI. The Native AI-Agentic Cloud Platform to Supercharge Quality Engineering.

labels.chat_error_service_unavailable=The AI service is temporarily unavailable. Please try again later.
labels.chat_error_timeout=The request timed out. Please try again.
labels.chat_error_context_length_exceeded=The message is too long to process. Please shorten it and try again.
labels.chat_error_model_not_found=The AI model was not found. Please contact the administrator.
labels.chat_error_invalid_response=Received an invalid response from the AI service. Please try again.

		t.Run(ei.Name, func(t *testing.T) {
			ai := actual[i]
			tests.AssertObjEqual(t, ai, ei, "Name", "Class", "Type", "Where", "Comment", "Option")

			if len(ei.Fields) != len(ai.Fields) {
				t.Errorf("expected index %q field length is %d but actual %d", ei.Name, len(ei.Fields), len(ai.Fields))
				return
			}
			for i, ef := range ei.Fields {
				af := ai.Fields[i]

- 並且應用沒有任何身分驗證，假設同一個網路中的任何請求都可被信任

## 攻擊範例 { #example-attack }

假設你打造了一個在本機執行 AI 代理（AI agent）的方法。

它提供一個 API：

```
http://localhost:8000/v1/agents/multivac
```

同時也有一個前端：

```
http://localhost:8000
```

/// tip | 提示

請注意兩者的主機（host）相同。

///

接著你可以透過前端讓 AI 代理代你執行動作。

由於它在本機執行、而非公開的網際網路上，你決定不設定任何身分驗證，只信任對本機網路的存取。

然後你的某位使用者可能安裝並在本機執行它。