Spaces:
Running
Running
| # Input-ingestion security hardening | |
| The input pipeline now applies these protections at the resolver boundary: | |
| - URL fetching accepts only HTTP(S), rejects URL credentials and malformed ports, resolves using the scheme's correct default port, and rejects hostnames with any non-global DNS answer when private URLs are disabled. | |
| - Redirects are handled manually, with each destination revalidated before the next request. | |
| - HTTPX environment proxy settings are not inherited for remote media fetches, avoiding an ambient proxy changing the destination semantics. | |
| - Remote downloads remain streamed to disk with a hard byte limit, including responses that omit or misstate Content-Length. Partial files are removed on download/validation failures. | |
| - Client filenames are normalized across POSIX and Windows separators and reject control characters and quote characters that can corrupt response headers. | |
| ## Deployment notes and remaining limits | |
| - `ALLOW_PRIVATE_URLS=true` intentionally disables the private-address block; only enable it in a trusted, isolated environment. | |
| - DNS validation and the HTTP client's subsequent connection resolution are separate operations. For hostile URL-fetching environments, production-grade SSRF protection should additionally pin the connection to a validated IP while preserving TLS hostname verification, or enforce egress restrictions at the network layer. | |
| - Multipart parsing can spool uploads before application-level per-file limits are applied. Enforce request-body limits at the reverse proxy/ASGI boundary as well as in the resolver. | |
| - Source-level regression tests were added but have not been run in the hosted environment. Deployment and live SSRF tests remain unverified. | |