📝 Description

Summary

Fix SSRF vulnerability where URLSanitizer.validate_url() bypassed blocked-network checks for hostname-based URLs (e.g., http://localhost, http://internal-host.example). The _validate_ip_address() method returned early for non-IP hosts, allowing hostnames that resolve to private IPs to pass validation.

Changes

security/url_sanitizer.py

• DNS resolution for hostnames: _validate_ip_address() now resolves hostnames via socket.getaddrinfo() and checks all resolved IPs against blocked networks. If resolution fails, an InvalidURLError is raised.
• Port validation: Added BLOCKED_PORTS set (~80 dangerous ports including SSH:22, MySQL:3306, Redis:6379, Docker:2375, etc.) and allowed_ports constructor parameter for allowlist-based port control. _validate_port() is called during validate_url().
• _check_blocked_ip: Extracted the blocked-network check into a reusable helper.
• allowed_ports parameter: Added to both URLSanitizer.__init__ and the convenience validate_url() function.

tests/test_security.py

Added 9 new tests covering:

• Hostname resolving to private IP (DNS-based SSRF) is blocked
• allow_localhost / allow_private flags work with hostname-based URLs
• Unresolvable hostnames raise InvalidURLError
• Blocked ports (e.g., SSH:22) are rejected
• Blocked port + private hostname combo is rejected
• Port allowlist works correctly
• Non-blocked ports pass validation

🔗 Linked Issue

Closes #1541

📋 Contribution Checklist

• I have verified that my files are placed in the correct directory.
• I have tested my changes thoroughly on my local machine.
• GSSoC 2026: I have been formally assigned to this issue and noted it above.