🛡️ Sentinel: [HIGH] Fix SSRF via DNS resolution check by google-labs-jules[bot] · Pull Request #92 · abhimehro/ctrld-sync

google-labs-jules · 2026-01-11T10:59:49Z

🚨 Severity: HIGH
💡 Vulnerability: SSRF (Server-Side Request Forgery) via folder-url parameter.
🎯 Impact: Attackers could potentially access internal services or the loopback interface by providing a domain that resolves to a private IP (e.g. local.attacker.com -> 127.0.0.1).
🔧 Fix: Added DNS resolution step in URL validation. The system now resolves the hostname and verifies that none of the resulting IPs are private or loopback addresses.
✅ Verification: Added tests/test_ssrf.py which mocks DNS responses to verify that private IPs (IPv4 and IPv6) are rejected, while public IPs are accepted.

PR created automatically by Jules for task 2009760983712888116 started by @abhimehro

Resolves domain names in `validate_folder_url` to ensure they do not point to private or loopback IP addresses. This mitigates SSRF attacks where a user-provided domain could target internal services. - Uses `socket.getaddrinfo` to support both IPv4 and IPv6. - Checks all resolved addresses against private/loopback ranges. - Fails closed if DNS resolution fails. - Adds comprehensive tests in `tests/test_ssrf.py`.

google-labs-jules · 2026-01-11T10:59:50Z

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

trunk-io · 2026-01-11T10:59:52Z

Merging to main in this repository is managed by Trunk.

To merge this pull request, check the box to the left or comment /trunk merge below.

main.py

        except ValueError:
-            # Not an IP literal, it's a domain.
-            pass
+            # Not an IP literal, it's a domain. Resolve it to prevent SSRF against internal services.


main.py

+                addr_info = socket.getaddrinfo(hostname, None)
+                for res in addr_info:
+                    # res is (family, type, proto, canonname, sockaddr)
+                    # sockaddr is (address, port) for IPv4 and (address, port, flow info, scope id) for IPv6


main.py

+                    ip_str = res[4][0]
+                    ip_obj = ipaddress.ip_address(ip_str)
+                    if ip_obj.is_private or ip_obj.is_loopback:
+                        log.warning(f"Skipping unsafe URL (domain resolves to private IP {ip_str}): {sanitize_for_log(url)}")


main.py

+                        log.warning(f"Skipping unsafe URL (domain resolves to private IP {ip_str}): {sanitize_for_log(url)}")
+                        return False
+            except Exception as e:
+                log.warning(f"Skipping unsafe URL (DNS resolution failed): {sanitize_for_log(url)} ({e})")


tests/test_ssrf.py

@@ -0,0 +1,70 @@
+import unittest


tests/test_ssrf.py

+# Add parent directory to path to import main
+sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from main import validate_folder_url


tests/test_ssrf.py

+
+from main import validate_folder_url
+
+class TestSSRF(unittest.TestCase):


main.py

+                    ip_str = res[4][0]
+                    ip_obj = ipaddress.ip_address(ip_str)
+                    if ip_obj.is_private or ip_obj.is_loopback:
+                        log.warning(f"Skipping unsafe URL (domain resolves to private IP {ip_str}): {sanitize_for_log(url)}")


main.py

+                        log.warning(f"Skipping unsafe URL (domain resolves to private IP {ip_str}): {sanitize_for_log(url)}")
+                        return False
+            except Exception as e:
+                log.warning(f"Skipping unsafe URL (DNS resolution failed): {sanitize_for_log(url)} ({e})")


tests/test_ssrf.py

+# Add parent directory to path to import main
+sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from main import validate_folder_url


tests/test_ssrf.py

+
+        self.assertFalse(validate_folder_url(url), "Should reject domain that fails resolution")
+
+if __name__ == '__main__':


main.py

        except ValueError:
-            # Not an IP literal, it's a domain.
-            pass
+            # Not an IP literal, it's a domain. Resolve it to prevent SSRF against internal services.


main.py

-            pass
+            # Not an IP literal, it's a domain. Resolve it to prevent SSRF against internal services.
+            try:
+                # Use getaddrinfo to support both IPv4 and IPv6 and check all resolved addresses


main.py

+                addr_info = socket.getaddrinfo(hostname, None)
+                for res in addr_info:
+                    # res is (family, type, proto, canonname, sockaddr)
+                    # sockaddr is (address, port) for IPv4 and (address, port, flow info, scope id) for IPv6


main.py

+                    ip_str = res[4][0]
+                    ip_obj = ipaddress.ip_address(ip_str)
+                    if ip_obj.is_private or ip_obj.is_loopback:
+                        log.warning(f"Skipping unsafe URL (domain resolves to private IP {ip_str}): {sanitize_for_log(url)}")


main.py

+                        log.warning(f"Skipping unsafe URL (domain resolves to private IP {ip_str}): {sanitize_for_log(url)}")
+                        return False
+            except Exception as e:
+                log.warning(f"Skipping unsafe URL (DNS resolution failed): {sanitize_for_log(url)} ({e})")


tests/test_ssrf.py

+# Add parent directory to path to import main
+sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from main import validate_folder_url


tests/test_ssrf.py

+
+from main import validate_folder_url
+
+class TestSSRF(unittest.TestCase):


main.py

-            pass
+            # Not an IP literal, it's a domain. Resolve it to prevent SSRF against internal services.
+            try:
+                # Use getaddrinfo to support both IPv4 and IPv6 and check all resolved addresses


main.py

+                    ip_str = res[4][0]
+                    ip_obj = ipaddress.ip_address(ip_str)
+                    if ip_obj.is_private or ip_obj.is_loopback:
+                        log.warning(f"Skipping unsafe URL (domain resolves to private IP {ip_str}): {sanitize_for_log(url)}")


main.py

+                        log.warning(f"Skipping unsafe URL (domain resolves to private IP {ip_str}): {sanitize_for_log(url)}")
+                        return False
+            except Exception as e:
+                log.warning(f"Skipping unsafe URL (DNS resolution failed): {sanitize_for_log(url)} ({e})")


abhimehro · 2026-01-18T21:24:16Z

Superseded: SSRF DNS resolution fix already in main via PR #109.

google-labs-jules · 2026-01-18T21:25:31Z

Superseded: SSRF DNS resolution fix already in main via PR #109.

Understood. Acknowledging that this work is now obsolete as it has been addressed in PR #109. I will stop work on this task.

github-actions bot added the python label Jan 11, 2026

github-advanced-security bot found potential problems Jan 11, 2026

View reviewed changes

abhimehro closed this Jan 18, 2026


		from main import validate_folder_url

		class TestSSRF(unittest.TestCase):


		self.assertFalse(validate_folder_url(url), "Should reject domain that fails resolution")

		if __name__ == '__main__':

Conversation

google-labs-jules bot commented Jan 11, 2026

Uh oh!

google-labs-jules bot commented Jan 11, 2026

Uh oh!

trunk-io bot commented Jan 11, 2026

Uh oh!

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check warning

Check notice

Check notice

Check notice

abhimehro commented Jan 18, 2026

Uh oh!

google-labs-jules bot commented Jan 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant