fix(security): apply _is_ssrf_host() guard to wizard test endpoint orch_url and ollama_host #133

New issue

Open

opened 2026-07-07 22:59:41 -07:00 by pyr0ball · 0 comments

pyr0ball commented

2026-07-07 22:59:41 -07:00

Owner

Issue

The /api/wizard/test endpoint accepts orch_url and ollama_host from user input and makes outbound HTTP requests without applying the _is_ssrf_host() SSRF guard that already exists in dev-api.py.

Affected code

dev-api.py — wizard test endpoint:

payload.orch_url → passed to _container_safe_url() but not _is_ssrf_host() check
payload.ollama_host → used directly without SSRF validation
Both requests.get() calls use default allow_redirects=True which allows 302 redirect to internal addresses (e.g. 169.254.169.254)

Fix

Parse hostname from orch_url and ollama_host with urllib.parse.urlparse(...).hostname
Reject if _is_ssrf_host(hostname) returns True (same guard used by test_email)
Pass allow_redirects=False to both requests.get() calls
In cloud mode, consider requiring admin/owner role for wizard test endpoints

Severity

Medium — requires authenticated wizard access; partially mitigated by _container_safe_url() but redirect bypass is real.

## Issue The `/api/wizard/test` endpoint accepts `orch_url` and `ollama_host` from user input and makes outbound HTTP requests without applying the `_is_ssrf_host()` SSRF guard that already exists in dev-api.py. ## Affected code `dev-api.py` — wizard test endpoint: - `payload.orch_url` → passed to `_container_safe_url()` but not `_is_ssrf_host()` check - `payload.ollama_host` → used directly without SSRF validation - Both `requests.get()` calls use default `allow_redirects=True` which allows 302 redirect to internal addresses (e.g. `169.254.169.254`) ## Fix 1. Parse hostname from `orch_url` and `ollama_host` with `urllib.parse.urlparse(...).hostname` 2. Reject if `_is_ssrf_host(hostname)` returns True (same guard used by `test_email`) 3. Pass `allow_redirects=False` to both `requests.get()` calls 4. In cloud mode, consider requiring admin/owner role for wizard test endpoints ## Severity Medium — requires authenticated wizard access; partially mitigated by `_container_safe_url()` but redirect bypass is real.