fix(security): validate bedrock endpoint URLs

src/renderer/components/settings/forms/AwsForm.tsx

@@ -1,4 +1,5 @@
 import { useState } from "react";
+import { isAwsBedrockEndpointUrl } from "@shared/contracts/schemas-credentials";
 import { ActionButton, Input, Select } from "../../ui";
 import { useT } from "../../../i18n";
 
@@ -43,6 +44,11 @@ export function AwsForm({ connectorId, onSaved }: Props) {
       setError(t("form.aws.errBearerRequired"));
       return;
     }
+    const trimmedEndpointUrl = endpointUrl.trim();
+    if (trimmedEndpointUrl && !isAwsBedrockEndpointUrl(trimmedEndpointUrl)) {
+      setError(t("form.aws.errEndpointUrlInvalid"));
+      return;
+    }
     setBusy(true);
     setError(null);
     const result = await desktop.saveCredential({
@@ -59,7 +65,7 @@ export function AwsForm({ connectorId, onSaved }: Props) {
             authMode === "iam" && sessionToken.trim() ? sessionToken.trim() : undefined,
           bearerToken: authMode === "bearer" ? bearerToken.trim() : undefined,
           forceCache,
-          endpointUrl: endpointUrl.trim() || undefined,
+          endpointUrl: trimmedEndpointUrl || undefined,
           skipAuth,
           forceHttp1,
         },

src/renderer/i18n/en.ts

@@ -1181,6 +1181,7 @@ export const en: Record<string, string> = {
   "form.aws.errProfileRequired": "AWS profile name required.",
   "form.aws.errIamRequired": "Access key id and secret access key required for IAM auth.",
   "form.aws.errBearerRequired": "Bearer token required.",
+  "form.aws.errEndpointUrlInvalid": "Endpoint URL must be an HTTPS AWS Bedrock runtime endpoint or a private endpoint.",
   "form.azure.apiKey": "API key",
   "form.azure.baseUrl": "Base URL (optional)",
   "form.azure.resourceName": "Resource name (optional)",

src/renderer/i18n/zh.ts

@@ -1181,6 +1181,7 @@ export const zh: Record<string, string> = {
   "form.aws.errProfileRequired": "请填写 AWS Profile 名称。",
   "form.aws.errIamRequired": "IAM 认证需要 Access Key ID 和 Secret Access Key。",
   "form.aws.errBearerRequired": "请填写 Bearer Token。",
+  "form.aws.errEndpointUrlInvalid": "Endpoint URL 必须是 HTTPS AWS Bedrock Runtime endpoint 或私有 endpoint。",
   "form.azure.apiKey": "API Key",
   "form.azure.baseUrl": "Base URL（可选）",
   "form.azure.resourceName": "资源名称（可选）",