omni-lpr

Critical security risks identified: 1. Server-Side Request Forgery (SSRF) / Local File Inclusion (LFI): The `recognize_plate_from_path` and `detect_and_recognize_plate_from_path` tools accept a `path` argument (URL or local file path). The application fetches images from these paths using `httpx.get` or `anyio.Path.read_bytes` without apparent validation or sanitization of the path's content. This could allow an attacker to read arbitrary local files, scan internal networks, or trigger denial-of-service by targeting large/slow external resources. 2. Broad CORS Policy: The server's CORS middleware allows origins from `*` (all origins), which is overly permissive and can pose a security risk in browser-based applications if not adequately protected by a stricter reverse proxy. Note: `avg_tokens_per_call` is a placeholder for computational load, as this is not an LLM application.