Harden fetch SSRF protection and git repo_path restriction - #4803
Open
sachajw wants to merge 1 commit into
Open
Conversation
fetch server: block requests to private/loopback/link-local/reserved addresses by default (resolved via socket.getaddrinfo, not just hostname string matching), and manually re-validate every redirect hop instead of trusting httpx's follow_redirects=True. Both closable via a new --allow-private-ips flag for trusted deployments. git server: restrict repo_path to the current working directory by default when --repository isn't passed, instead of leaving it completely unrestricted. New --allow-any-repository flag restores the old behavior. Documented both in SECURITY.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two hardening fixes found during local security review of the reference
fetchandgitservers. Both are additive and default to the safer behavior, with an explicit opt-out flag for anyone who needs the old, permissive behavior.fetchserver — SSRF protection.fetch_url()/check_may_autonomously_fetch_url()previously calledhttpx.AsyncClient.get()withfollow_redirects=Trueand no restriction on the resolved target address, so a client could point the server at loopback/private/link-local addresses (e.g. cloud metadata endpoints, internal services) directly, or reach them indirectly via a redirect. Now:check_url_is_not_internal()resolves the hostname viasocket.getaddrinfo()and rejects the request if any resolved address is private/loopback/link-local/multicast/reserved/unspecified.httpxto follow them blindly.--allow-private-ipsflag disables this for trusted deployments.gitserver — unrestrictedrepo_pathwhen--repositoryisn't set.validate_repo_path()only enforced a boundary when--repositorywas passed; without it,allowed_repositorywasNoneand anyrepo_pathwas accepted by every tool. Nowserve()defaultsallowed_repositoryto the current working directory instead of leaving it unrestricted. New--allow-any-repositoryflag restores the previous behavior.Both changes are documented in
SECURITY.md(new "Local security hardening" section, existing disclosure-policy content unchanged).Test plan
cd src/fetch && uv run pytest -q— 20 passed (fixed one test that used a non-resolvable subdomain unrelated to the SSRF logic)cd src/git && uv run pytest -q— 47 passedpy_compileon all touched files🤖 Generated with Claude Code