fix(aiohttp): block private/reserved IPs in aiohttp handler to close SSRF gap (CWE-918) - #30284

Open

DrishnaTrivedi wants to merge 15 commits into

BerriAI:mainfrom

DrishnaTrivedi:fix/aiohttp-ssrf-cwe918

Commits on Jun 12, 2026

fix(aiohttp): block private/metadata IPs in api_base to close SSRF gap from #26264 (CWE-918)

DrishnaTrivedi
and
claude
committed
03212de
test(aiohttp): add coverage for all edge-case branches in SSRF guard

DrishnaTrivedi
and
claude
committed
23d6cc5
fix(aiohttp/ssrf): use get_running_loop and propagate gaierror in SSRFGuardResolver

DrishnaTrivedi
and
claude
committed
27a02db
fix(aiohttp/ssrf): add allow_requests_to_internal_ips opt-out and fix asyncio deprecation

DrishnaTrivedi
and
claude
committed
4bd5123
fix(aiohttp/ssrf): block IPv6 unspecified address (::) to close wildcard bypass

DrishnaTrivedi
and
claude
committed
7b1dce6
ci: trigger CI checks
DrishnaTrivedi
committed
47859e4
fix(aiohttp/ssrf): use is_global for complete IP blocking and remove async preflight

DrishnaTrivedi
and
claude
committed
796a5ac
fix(aiohttp/ssrf): block IP-literal URLs that bypass TCPConnector resolver

DrishnaTrivedi
and
claude
committed
5fab01a
fix(aiohttp/ssrf): close DNS-rebinding TOCTOU on sync path via _SSRFGuardTransport

DrishnaTrivedi
and
claude
committed
8cf6f46
fix(ssrf): validate IP-literal hosts directly in _SSRFGuardTransport

DrishnaTrivedi
and
claude
committed
9c20552
fix(aiohttp/ssrf): block IP-literal redirect targets via TraceConfig

authored and
DrishnaTrivedi
committed
fd481b6
fix(aiohttp/ssrf): restore connection-pool caching and forward SSL config

authored and
DrishnaTrivedi
committed
e565f1e
style: black format http_handler.py
DrishnaTrivedi
committed
6f48093
fix(ssrf): fix Host header port, resolver flags, and DNS failure handling in SSRF guards
DrishnaTrivedi
committed
9c9eda2
test(ssrf): add missing coverage for no-hostname path, absent cache, and transport init failure
DrishnaTrivedi
committed
8e4d8a9

Navigation Menu

Uh oh!

fix(aiohttp): block private/reserved IPs in aiohttp handler to close SSRF gap (CWE-918) - #30284

fix(aiohttp): block private/reserved IPs in aiohttp handler to close SSRF gap (CWE-918)#30284
DrishnaTrivedi wants to merge 15 commits into
BerriAI:mainfrom
DrishnaTrivedi:fix/aiohttp-ssrf-cwe918

Commits on Jun 12, 2026

fix(aiohttp): block private/metadata IPs in api_base to close SSRF gap from #26264 (CWE-918)

test(aiohttp): add coverage for all edge-case branches in SSRF guard

fix(aiohttp/ssrf): use get_running_loop and propagate gaierror in SSRFGuardResolver

fix(aiohttp/ssrf): add allow_requests_to_internal_ips opt-out and fix asyncio deprecation

fix(aiohttp/ssrf): block IPv6 unspecified address (::) to close wildcard bypass

ci: trigger CI checks

fix(aiohttp/ssrf): use is_global for complete IP blocking and remove async preflight

fix(aiohttp/ssrf): block IP-literal URLs that bypass TCPConnector resolver

fix(aiohttp/ssrf): close DNS-rebinding TOCTOU on sync path via _SSRFGuardTransport

fix(ssrf): validate IP-literal hosts directly in _SSRFGuardTransport

fix(aiohttp/ssrf): block IP-literal redirect targets via TraceConfig

fix(aiohttp/ssrf): restore connection-pool caching and forward SSL config

style: black format http_handler.py

fix(ssrf): fix Host header port, resolver flags, and DNS failure handling in SSRF guards

test(ssrf): add missing coverage for no-hostname path, absent cache, and transport init failure