Fix: URLSanitizer does not validate/limit URL ports and can permit access to sensitive ports

[Kirtan-pc]

📝 Description

Summary

Add port validation to URLSanitizer.validate_url() to prevent SSRF attacks targeting dangerous ports (e.g., SSH:22, MySQL:3306, Redis:6379, Docker:2375) on allowed hosts.

Changes

security/url_sanitizer.py

• BLOCKED_PORTS: Added class constant with ~80 known dangerous ports spanning SSH, SMB, MySQL, PostgreSQL, Redis, Docker, Memcached, MongoDB, LDAP, SMTP, and more.
• allowed_ports parameter: Added to __init__ — when provided, acts as an allowlist (only these ports are permitted); when None, the BLOCKED_PORTS deny list is used.
• _validate_port(): New method called during validate_url() that checks the parsed port against the blocked set or allowlist. Also validates port range (1–65535).
• Convenience validate_url(): Updated to accept and forward allowed_ports.

tests/test_security.py

Added 5 new tests:

• test_blocked_port — blocked port (SSH:22) on a public hostname is rejected
• test_blocked_port_on_ip_literal — blocked port on an IP literal is rejected
• test_allowed_ports_allowlist — allowlist mode permits specified ports
• test_allowed_ports_rejects_non_allowed — allowlist rejects unspecified ports
• test_valid_port_not_blocked — non-blocked port passes validation

🔗 Linked Issue

Closes #1542

---

📋 Contribution Checklist

• I have verified that my files are placed in the correct directory.
• I have tested my changes thoroughly on my local machine.
• GSSoC 2026: I have been formally assigned to this issue and noted it above.

[vercel]

@Kirtan-pc is attempting to deploy a commit to the Anuj's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

🎉 Thank you for your contribution!

Your Pull Request has been merged successfully.
Thanks again for your support! 🙌