aidputils.agents.tools.http.url_validator

URL Validator for HTTP Tool.

Provides SSRF (Server-Side Request Forgery) prevention: - Protocol allowlist (http/https only) - Private IP blocking (RFC 1918, loopback, link-local) - Cloud metadata endpoint blocking - Hostname blocking (localhost)

exception aidputils.agents.tools.http.url_validator.SSRFError[source]

Bases: ValueError

Exception raised when SSRF protection blocks a request.

aidputils.agents.tools.http.url_validator.is_private_ip(ip_str: str) → bool[source]

Check if an IP address is in a private/blocked range.

Parameters:

ip_str – IP address string

Returns:

True if the IP is private/blocked, False otherwise

aidputils.agents.tools.http.url_validator.is_blocked_hostname(hostname: str) → bool[source]

Check if a hostname is blocked.

Parameters:

hostname – Hostname to check

Returns:

True if the hostname is blocked, False otherwise

aidputils.agents.tools.http.url_validator.resolve_hostname(hostname: str) → str | None[source]

Resolve a hostname to an IP address.

Parameters:

hostname – Hostname to resolve

Returns:

IP address string, or None if resolution fails

aidputils.agents.tools.http.url_validator.validate_url(url: str, resolve_dns: bool = True) → Tuple[str, str, int][source]

Validate a URL for SSRF protection.

Parameters:

  • url – The URL to validate

  • resolve_dns – Whether to resolve hostname and check IP (default True)

Returns:

Tuple of (scheme, hostname, port)

Raises:

SSRFError – If the URL is blocked by SSRF protection

aidputils.agents.tools.http.url_validator.validate_redirect_url(original_url: str, redirect_url: str, resolve_dns: bool = True) → Tuple[str, str, int][source]

Validate a redirect target URL for SSRF protection.

This applies the same validation as the original URL to prevent redirect-based SSRF bypass attacks.

Parameters:

  • original_url – The original request URL

  • redirect_url – The redirect target URL

  • resolve_dns – Whether to resolve hostname and check IP

Returns:

Tuple of (scheme, hostname, port)

Raises:

SSRFError – If the redirect URL is blocked

aidputils.agents.tools.http.url_validator.is_url_safe(url: str, resolve_dns: bool = True) → bool[source]

Check if a URL is safe (not blocked by SSRF protection).

Parameters:

  • url – The URL to check

  • resolve_dns – Whether to resolve hostname and check IP

Returns:

True if the URL is safe, False otherwise