SSRF protection — block requests to private IPs and cloud metadata endpoints.
Functions
is_private_ip(ip_str: str) -> bool
Check if an IP address is private/reserved.
Source code in src/openjarvis/security/ssrf.py
| def is_private_ip(ip_str: str) -> bool:
"""Check if an IP address is private/reserved."""
try:
addr = ipaddress.ip_address(ip_str)
except ValueError:
return False
# Normalize IPv4-mapped / IPv4-compatible IPv6 to the embedded IPv4 so
# the IPv4 private-range CIDRs apply. Without this, e.g. ::ffff:127.0.0.1
# bypasses the loopback / RFC1918 checks.
if isinstance(addr, ipaddress.IPv6Address):
embedded = _embedded_ipv4(addr)
if embedded is not None:
addr = embedded
return any(addr in net for net in _BLOCKED_CIDR)
|
check_ssrf(url: str) -> Optional[str]
Check a URL for SSRF vulnerabilities — always via Rust backend.
Source code in src/openjarvis/security/ssrf.py
| def check_ssrf(url: str) -> Optional[str]:
"""Check a URL for SSRF vulnerabilities — always via Rust backend."""
from openjarvis._rust_bridge import get_rust_module
_rust = get_rust_module()
return _rust.check_ssrf(url)
|