SSRF hardening for server-side media fetches in the AI vision stage #108

New issue

Open

opened 2026-09-08 01:20:10 +00:00 by agent-pi · 0 comments

agent-pi commented

2026-09-08 01:20:10 +00:00

Collaborator

Problem

download_first_image fetches image URLs taken directly from post media_attachments (preview_url / url) server-side. Those URLs are chosen by the post's author (or their instance), so a malicious post can point fenliu's server at internal addresses — cloud metadata endpoints such as 169.254.169.254, or any internal service — and probe them: a Server-Side Request Forgery vector (OWASP A10).

PR #107 added follow_redirects=True to this client (fixing #105, media_proxy redirects), which extends the surface: an initially-harmless URL can additionally redirect to an internal target. Note the underlying exposure exists without redirects, since the initial URL is already attacker-chosen.

Constraints / notes

Fetched bytes are base64-encoded and sent to the AI vision API; they are not reflected back to the post author, which limits exfiltration to timing and side channels.
A redirect-only guard would be a partial fix; the initial URL needs the same validation.
The AI API client (ai_classification.py) only calls the operator-configured base URL and is not affected.

Raised by WuMing (security, HIGH) during review of PR #107; decision was to keep #105 minimal (it restores intended behaviour) and design the hardening properly here.

## Problem `download_first_image` fetches image URLs taken directly from post `media_attachments` (`preview_url` / `url`) server-side. Those URLs are chosen by the post's author (or their instance), so a malicious post can point fenliu's server at internal addresses — cloud metadata endpoints such as `169.254.169.254`, or any internal service — and probe them: a Server-Side Request Forgery vector (OWASP A10). PR #107 added `follow_redirects=True` to this client (fixing #105, media_proxy redirects), which extends the surface: an initially-harmless URL can additionally redirect to an internal target. Note the underlying exposure exists without redirects, since the initial URL is already attacker-chosen. ## Constraints / notes - Fetched bytes are base64-encoded and sent to the AI vision API; they are not reflected back to the post author, which limits exfiltration to timing and side channels. - A redirect-only guard would be a partial fix; the initial URL needs the same validation. - The AI API client (`ai_classification.py`) only calls the operator-configured base URL and is not affected. Raised by WuMing (security, HIGH) during review of PR #107; decision was to keep #105 minimal (it restores intended behaviour) and design the hardening properly here.

agent-pi referenced this issue

2026-09-08 01:20:26 +00:00

Follow redirects when downloading AI vision images #107

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

marvin8/dujiangyan#108

No description provided.

Rows
Columns