mirror of
https://github.com/Sea-Haven-Industries/open-swe.git
synced 2026-09-30 10:23:14 +00:00
a9331e78e6
* fix: harden http_request SSRF guard against DNS rebinding [closes AB-2321] Pin DNS resolution per request hop so urllib3's connection-time lookup cannot rebind to a private IP after _is_url_safe validated a public one. Co-authored-by: Johannes du Plessis <51395795+johannes117@users.noreply.github.com> * fix: scope DNS pin to urllib3 with reference-counted install Address review feedback: the previous version permanently overwrote the process-global socket.getaddrinfo on first use. Now the patch targets urllib3.util.connection.create_connection (much narrower blast radius), and is installed/uninstalled via reference count so no global mutation persists once no http_request calls are in flight. Co-authored-by: Johannes du Plessis <51395795+johannes117@users.noreply.github.com> * fix: forward timeout and socket_options through pinned create_connection urllib3 calls create_connection with timeout positional and socket_options as a keyword. The previous wrapper only read kwargs, silently dropping the caller's connect timeout (so a slow validated IP could hang) and TCP options like TCP_NODELAY. Accept both positionally and forward them to the underlying socket. --------- Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com> Co-authored-by: Johannes du Plessis <51395795+johannes117@users.noreply.github.com> Co-authored-by: Johannes du Plessis <johannes@langchain.dev> |
||
|---|---|---|
| .. | ||
| middleware | ||
| test_auth_sources.py | ||
| test_daytona_integration.py | ||
| test_encryption.py | ||
| test_ensure_no_empty_msg.py | ||
| test_github_comment_prompts.py | ||
| test_github_issue_webhook.py | ||
| test_http_security.py | ||
| test_langsmith_sandbox_config.py | ||
| test_multimodal.py | ||
| test_notify_step_limit_middleware.py | ||
| test_proxy_auth.py | ||
| test_public_repo_org_gate.py | ||
| test_recent_comments.py | ||
| test_refresh_slack_status_middleware.py | ||
| test_repo_extraction.py | ||
| test_reviewer.py | ||
| test_reviewer_diff.py | ||
| test_reviewer_findings.py | ||
| test_reviewer_publish.py | ||
| test_reviewer_tools.py | ||
| test_reviewer_watch.py | ||
| test_sandbox_paths.py | ||
| test_sanitize_tool_inputs.py | ||
| test_slack_assistants_status.py | ||
| test_slack_context.py | ||
| test_slack_feedback.py | ||