Fix/aiohttp ssrf cwe918 - #28252

Closed

DrishnaTrivedi wants to merge 12 commits into

BerriAI:shin_agent_oss_staging_05_22_2026from

DrishnaTrivedi:fix/aiohttp-ssrf-cwe918

Commits on May 19, 2026

fix(aiohttp): block private/metadata IPs in api_base to close SSRF gap from #26264 (CWE-918)

DrishnaTrivedi
and
claude
committed
537db99
test(aiohttp): add coverage for all edge-case branches in SSRF guard

DrishnaTrivedi
and
claude
committed
80cea73
fix(aiohttp/ssrf): use get_running_loop and propagate gaierror in SSRFGuardResolver

DrishnaTrivedi
and
claude
committed
eb9914e

Commits on May 20, 2026

fix(aiohttp/ssrf): add allow_requests_to_internal_ips opt-out and fix asyncio deprecation

DrishnaTrivedi
and
claude
committed
a9cdbca
fix(aiohttp/ssrf): block IPv6 unspecified address (::) to close wildcard bypass

DrishnaTrivedi
and
claude
committed
fc7718c
ci: trigger CI checks
DrishnaTrivedi
committed
6c22ca0
fix(aiohttp/ssrf): use is_global for complete IP blocking and remove async preflight

DrishnaTrivedi
and
claude
committed
90ec5dc

Commits on May 21, 2026

fix(aiohttp/ssrf): block IP-literal URLs that bypass TCPConnector resolver

DrishnaTrivedi
and
claude
committed
1bc6fc8

Commits on Jun 2, 2026

fix(aiohttp/ssrf): close DNS-rebinding TOCTOU on sync path via _SSRFGuardTransport

DrishnaTrivedi
and
claude
committed
3aff456

Commits on Jun 3, 2026

fix(ssrf): validate IP-literal hosts directly in _SSRFGuardTransport

DrishnaTrivedi
and
claude
committed
7dad714

Commits on Jun 4, 2026

fix(aiohttp/ssrf): block IP-literal redirect targets via TraceConfig

Avani-prajapati
and
claude
committed
fedf0c7
fix(aiohttp/ssrf): restore connection-pool caching and forward SSL config

Avani-prajapati
and
claude
committed
2bde496