Skip to content

🛡️ Sentinel: Fix SSRF vulnerability in URL validation#89

Closed
google-labs-jules[bot] wants to merge 1 commit intomainfrom
sentinel-ssrf-fix-12945820800002383074
Closed

🛡️ Sentinel: Fix SSRF vulnerability in URL validation#89
google-labs-jules[bot] wants to merge 1 commit intomainfrom
sentinel-ssrf-fix-12945820800002383074

Conversation

@google-labs-jules
Copy link

@google-labs-jules google-labs-jules bot commented Jan 10, 2026

🛡️ Sentinel: [HIGH] Fix SSRF vulnerability in folder URL validation

🚨 Severity: HIGH
💡 Vulnerability: The previous validation logic allowed domains that resolve to private IP addresses (SSRF), as it only checked for explicit "localhost" strings or IP literals.
🎯 Impact: An attacker could potentially access internal network resources by providing a URL pointing to a local service via a domain name.
🔧 Fix: Updated validate_folder_url to resolve domain names to IP addresses and verify that they do not point to private or loopback ranges using the ipaddress library.
✅ Verification: Verified with a test script simulating domains resolving to private and public IPs.

PR created automatically by Jules for task 12945820800002383074 started by @abhimehro

@google-labs-jules
feat: Add SSRF protection by resolving domains in URL validation
d1c5ffc 
- Added DNS resolution to `validate_folder_url` to check for private IPs.
- Used `socket.gethostbyname` to resolve domains.
- Verified that resolved IPs are not private or loopback addresses.
- Added `socket` import.
@google-labs-jules
Copy link
Author

google-labs-jules bot commented Jan 10, 2026

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 10, 2026
View reviewed changes
main.py
resolved_ip_str = socket.gethostbyname(hostname)
resolved_ip = ipaddress.ip_address(resolved_ip_str)
if resolved_ip.is_private or resolved_ip.is_loopback:
log.warning(f"Skipping unsafe URL (domain resolves to private IP {resolved_ip_str}): {sanitize_for_log(url)}")

Check warning

Code scanning / Pylint (reported by Codacy)

Line too long (130/100) Warning

Line too long (130/100)
main.py
# We'll allow it to proceed to HTTP request which will likely fail,
# or we could be strict and reject it.
# Being strict is safer for security.
log.warning(f"Skipping unsafe URL (DNS resolution failed): {sanitize_for_log(url)}")

Check warning

Code scanning / Pylint (reported by Codacy)

Line too long (101/100) Warning

Line too long (101/100)
main.py
# Not an IP literal, it's a domain.
pass
try:
# Resolve domain to IP to check for private addresses (SSRF protection)

Check notice

Code scanning / Pylint (reported by Codacy)

Catching too general exception Exception Note

Catching too general exception Exception
main.py
# We'll allow it to proceed to HTTP request which will likely fail,
# or we could be strict and reject it.
# Being strict is safer for security.
log.warning(f"Skipping unsafe URL (DNS resolution failed): {sanitize_for_log(url)}")

Check notice

Code scanning / Pylint (reported by Codacy)

Bad indentation. Found 17 spaces, expected 16 Note

Bad indentation. Found 17 spaces, expected 16
main.py
# or we could be strict and reject it.
# Being strict is safer for security.
log.warning(f"Skipping unsafe URL (DNS resolution failed): {sanitize_for_log(url)}")
return False

Check notice

Code scanning / Pylint (reported by Codacy)

Bad indentation. Found 17 spaces, expected 16 Note

Bad indentation. Found 17 spaces, expected 16
github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 10, 2026
View reviewed changes
main.py
# or we could be strict and reject it.
# Being strict is safer for security.
log.warning(f"Skipping unsafe URL (DNS resolution failed): {sanitize_for_log(url)}")
return False

Check warning

Code scanning / Pylintpython3 (reported by Codacy)

Line too long (130/100) Warning

Line too long (130/100)
main.py Outdated

Check warning

Code scanning / Pylintpython3 (reported by Codacy)

Line too long (101/100) Warning

Line too long (101/100)
main.py Outdated

Check warning

Code scanning / Pylintpython3 (reported by Codacy)

Variable name "e" doesn't conform to snake_case naming style Warning

Variable name "e" doesn't conform to snake_case naming style
main.py
# or we could be strict and reject it.
# Being strict is safer for security.
log.warning(f"Skipping unsafe URL (DNS resolution failed): {sanitize_for_log(url)}")
return False

Check notice

Code scanning / Pylintpython3 (reported by Codacy)

Use lazy % formatting in logging functions Note

Use lazy % formatting in logging functions
main.py Outdated

Check notice

Code scanning / Pylintpython3 (reported by Codacy)

Use lazy % formatting in logging functions Note

Use lazy % formatting in logging functions
main.py Outdated

Check notice

Code scanning / Pylintpython3 (reported by Codacy)

Bad indentation. Found 17 spaces, expected 16 Note

Bad indentation. Found 17 spaces, expected 16
main.py Outdated

Check notice

Code scanning / Pylintpython3 (reported by Codacy)

Use lazy % formatting in logging functions Note

Use lazy % formatting in logging functions
github-advanced-security[bot]
github-advanced-security bot found potential problems Jan 10, 2026
View reviewed changes
main.py
# or we could be strict and reject it.
# Being strict is safer for security.
log.warning(f"Skipping unsafe URL (DNS resolution failed): {sanitize_for_log(url)}")
return False

Check warning

Code scanning / Prospector (reported by Codacy)

Use lazy % formatting in logging functions (logging-fstring-interpolation) Warning

Use lazy % formatting in logging functions (logging-fstring-interpolation)
main.py
return False
except Exception as e:
log.warning(f"Failed to resolve domain for URL {sanitize_for_log(url)}: {e}")
return False

Check warning

Code scanning / Prospector (reported by Codacy)

over-indented (comment) (E117) Warning

over-indented (comment) (E117)
main.py
return False
except Exception as e:
log.warning(f"Failed to resolve domain for URL {sanitize_for_log(url)}: {e}")
return False

Check warning

Code scanning / Prospector (reported by Codacy)

indentation is not a multiple of four (comment) (E114) Warning

indentation is not a multiple of four (comment) (E114)
main.py
except Exception as e:
log.warning(f"Failed to resolve domain for URL {sanitize_for_log(url)}: {e}")
return False

Check warning

Code scanning / Prospector (reported by Codacy)

indentation is not a multiple of four (comment) (E114) Warning

indentation is not a multiple of four (comment) (E114)
main.py
except Exception as e:
log.warning(f"Failed to resolve domain for URL {sanitize_for_log(url)}: {e}")
return False

Check warning

Code scanning / Prospector (reported by Codacy)

over-indented (comment) (E117) Warning

over-indented (comment) (E117)
main.py Outdated

Check warning

Code scanning / Prospector (reported by Codacy)

over-indented (E117) Warning

over-indented (E117)
main.py Outdated

Check warning

Code scanning / Prospector (reported by Codacy)

Use lazy % formatting in logging functions (logging-fstring-interpolation) Warning

Use lazy % formatting in logging functions (logging-fstring-interpolation)
main.py Outdated

Check warning

Code scanning / Prospector (reported by Codacy)

Use lazy % formatting in logging functions (logging-fstring-interpolation) Warning

Use lazy % formatting in logging functions (logging-fstring-interpolation)
main.py Outdated

Check warning

Code scanning / Prospector (reported by Codacy)

Bad indentation. Found 17 spaces, expected 16 (bad-indentation) Warning

Bad indentation. Found 17 spaces, expected 16 (bad-indentation)
main.py Outdated

Check warning

Code scanning / Prospector (reported by Codacy)

Use lazy % formatting in logging functions (logging-fstring-interpolation) Warning

Use lazy % formatting in logging functions (logging-fstring-interpolation)
@abhimehro
Copy link
Owner

abhimehro commented Jan 18, 2026

Superseded: SSRF protection already in main via PR #109.

@abhimehro abhimehro closed this Jan 18, 2026
@abhimehro abhimehro deleted the sentinel-ssrf-fix-12945820800002383074 branch January 19, 2026 05:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@abhimehro