🛡️ Sentinel: [HIGH] Fix empty hostname SSRF bypass

[seonghobae]

Security objective

Close the empty-host / unresolved-host SSRF validation weakness at its causal runtime boundary and preserve the defect class as executable AppGuardrail detection evidence.

Protected predecessor logic could normalize a missing hostname to "", let it reach DNS resolution, ignore socket.gaierror, and return success. This branch rejects missing hosts before DNS/IP validation and fails closed when a public destination cannot be established.

Runtime + detector contract

• appguardrail_core.controlplane._is_safe_url is the causal webhook/storage/redirect boundary; CLI _is_safe_url is defense in depth.
• Packaged HIGH/CWE-918 python-ssrf-empty-host-fail-open keeps bounded production _scan_file evidence for direct/empty-string-normalized hosts, multiline definitions, annotated assignments, dominating vs conditional guards, nonempty fallbacks, tuple DNS exceptions, diagnostic fallthrough, falsy/raise termination, and reviewed truthy success forms.
• Pinned HTTPS remains an independent transport obligation.

RED → GREEN lineage

• runtime fail-closed DNS repair: 62df0db1a831985fc34dbdc3565cfa2688facc98 → deterministic redirect evidence 5b79be8144f0444535ab12290851b7f8afe28538;
• detector edge RED/GREEN: 38bde3b74ec0ed606e884b9620273f60285c641c → 438c5ae5e607fe03bdeece44e4ab30dd55e8b67b;
• CLI resolver parity RED/GREEN: cb89d786f31ecf47dd24cda590c485ede2717194 → 8c06fe741a4c63d43495e536d06f0f2419a3109f.

Intervening-delta repair and successor consolidation

Earlier verified descendant 3c015e2e76d9df7cb20e5577c310fc3f2567519d retained the reviewed detector grammar and the credential-only hostless fixture used to consolidate generated PR #1103.

A later three-commit descendant ending at c5874eff879ee988d4b650bc2a952d3dae9a04da was re-read rather than treated as a race. Relative to 3c015e2... it removed tests/test_ssrf_empty_host_credentials_contract.py and tests/test_ssrf_empty_host_detector_edge_contract.py, narrowed the detector regex, and modified the general SSRF regression. The deleted contracts and narrowed detector were valid repair findings.

Normal descendants restored the reviewed detector and both lost regression surfaces without force/rebase:

• a31d91dbc43282655a5e8d9ca2550d64352ab7f7 restores the reviewed detector grammar;
• 5be43e8b45657b400866255dfe3d59539501ac19 restores the hostless credential contract and additionally inherits generated PR 🛡️ Sentinel: [CRITICAL] 빈 호스트명을 통한 SSRF 방어 우회 취약점 수정 #1113's unique http://user@/ fixture;
• bce54900be6794a0281e944c6816420a34622b13 restores the executable multiline/annotated/truthy-return detector edge contracts.

Fresh compare 3c015e2...bce5490 is ahead 6 / behind 0. Its only effective differences are the preserved deterministic tests/test_ssrf_protection.py refinement and the expanded hostless-credential regression; the detector and deleted edge contract are restored to the reviewed semantics.

Generated PR #1113's runtime guard is already present here for both control-plane and CLI. Its http://, http://user@, and http://user@/ behavioral evidence is now fully represented on this canonical lineage. Its generated .jules/sentinel.md repository-wide doctrine is not an independent product/security contract and is not required for succession.

Exact authority

• protected base: develop@e71d37e7c58118e6764c96ab7c4492fe33eed6f8
• exact head: 2379b37f05b12af8e22990965d42da2e69b9c611
• branch: sentinel/fix-empty-hostname-ssrf-14253541902387870366
• Draft; no force-push/destructive rebase/self-approval/gate weakening

Exact head 2379b37... is a source-neutral descendant and adds no product/security delta. All eight repository workflows are terminal success on this exact head. CodeQL PR run 34155024470 successfully dispatched exact-head Python and Actions analysis, then failed closed at VERDICT_STATE=pending; this is neither a source failure nor GREEN. No qualifying current-head approval exists. One outdated detector thread remains open until an independent current-head review confirms the bounded truthy-return repair. Predecessor evidence does not transfer.

Merge boundary

Not merge-ready. Require unchanged exact-head terminal-success applicable checks, qualifying independent current-head review, and ordinary protected-branch acceptance. No self-approval, stale evidence, force update, detector waiver, source-neutral retrigger, administrator bypass, or required-check weakening.

Generated PR #1128 complete carryover

Fresh comparison at 4a76b955ecc6e767e137ac15e82b83a2af148386 verified that this lane completely carries #1128's current hostless rejection and http:// / http://user@ regression obligations for both validators and the control-plane API. #1128's body-mentioned tests/test_hostless_url_admission.py is absent from its current four-file patch; its generated doctrine is not an independent product/security delta. #1128 may therefore be retired only as verified complete successor carryover, while this Draft remains the single writer.

The current head commit is a source-neutral workflow-retrigger descendant and adds no product/security delta. This checkpoint does not reuse the retrigger as proof and creates no further no-op commit; future transient workflow retries should use the GitHub rerun API.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

두 URL 검증기가 빈 호스트명을 DNS 해석 전에 거부합니다. DNS 해석 실패도 거부합니다. HIGH 등급 SSRF fail-open 탐지 규칙과 보안 픽스처를 추가했습니다. 규칙의 반환식과 예외 처리 경로를 회귀 테스트로 검증합니다.

Changes

빈 호스트명 SSRF 차단

Layer / File(s)	Summary
호스트명 검증 및 런타임 회귀 테스트 appguardrail_core/controlplane.py, scanner/cli/appguardrail.py, tests/test_ssrf_protection.py, tests/test_controlplane.py, .jules/sentinel.md	두 _is_safe_url 구현이 빈 호스트명을 거부합니다. DNS 해석 실패도 거부합니다. 관련 URL과 웹훅 테스트가 공개 IP 및 모킹된 DNS 결과를 사용합니다. 보안 기록에 취약점과 수정 방법을 추가했습니다.
빈 호스트 SSRF 탐지 규칙 scanner/rules/ssrf_empty_host.yml, tests/fixtures/security_corpus/*empty_host_ssrf*, CHANGELOG.d/1068-empty-host-ssrf.md, docs/TRACEABILITY.md	빈 호스트명을 DNS에 전달한 뒤 socket.gaierror를 무시하는 Python 패턴을 탐지하는 HIGH 등급 규칙을 추가했습니다. 취약·수정 픽스처와 변경 로그를 추가하고 추적성 규칙을 갱신했습니다.
탐지 규칙 회귀 검증 tests/test_ssrf_empty_host_validator_rule.py, tests/test_ssrf_empty_host_return_expression_regression.py, tests/test_ssrf_empty_host_sibling_except_regression.py, tests/test_ssrf_empty_host_current_review_regressions.py	규칙 등록, 취약 픽스처 탐지, 호스트 가드, 반환식, 조건식, 예외 튜플, 종료 경계, 함수 경계를 프로덕션 스캐너로 검증합니다.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Merge Risk: 🟡 Moderate · up to 81ee5

The runtime SSRF boundary now rejects empty and unresolved hosts, but the packaged detector can still miss documented vulnerable patterns and one regression test is DNS-dependent. The detector gap should be resolved before merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 67.24% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 58 functions across 10 files. (2 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	PR 제목은 빈 호스트 이름으로 발생하는 HIGH 등급 SSRF 우회 수정이라는 주요 변경을 정확하고 간결하게 설명합니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 67.24% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 58 functions across 10 files. (2 skipped: 2 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sentinel/fix-empty-hostname-ssrf-14253541902387870366

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

2026-09-07 exact-head successor consolidation

Generated PR #1128 was re-fetched at exact head 4a76b955ecc6e767e137ac15e82b83a2af148386 and compared with this canonical security lane at exact head a1174b33d194ec2421015cb54fa327bd5b6f7ad0; both fork protected develop@e71d37e7c58118e6764c96ab7c4492fe33eed6f8.

Verified complete carryover of every valid #1128 delta:

• both appguardrail_core.controlplane._is_safe_url and CLI _is_safe_url reject a missing hostname before DNS/IP validation;
• direct production regressions reject http:// and http://user@ in both validators, while the control-plane API contract rejects the same inputs with HTTP 400;
• this lane additionally fails closed on socket.gaierror, packages python-ssrf-empty-host-fail-open, and retains vulnerable/fixed corpus, traceability, and broader FP/FN regressions;
• fix(webhook): reject hostless HTTP(S) authorities #1128's body names tests/test_hostless_url_admission.py, but that path is absent from its current four-file patch, so it is not an uncarried current-head delta;
• the generated .jules/sentinel.md prose is repository-wide doctrine, not an independent product/security contract, and this lane already carries equivalent doctrine.

Therefore #1128 can be retired only as a verified complete-successor carryover, not as a claim that its finding was invalid. No commit or valid requirement is discarded.

Current acceptance remains blocked: eight repository-local workflows are exact-head success, but CodeQL PR run 33996585942 has DISPATCH_OUTCOME=success and VERDICT_STATE=pending; it intentionally fails until the authenticated terminal verdict is published. There is also no qualifying independent APPROVED review and one current review thread remains unresolved. This PR stays Draft and is not merged or auto-merged.

[google-labs-jules]

2026-09-07 exact-head successor consolidation

Generated PR #1128 was re-fetched at exact head 4a76b955ecc6e767e137ac15e82b83a2af148386 and compared with this canonical security lane at exact head a1174b33d194ec2421015cb54fa327bd5b6f7ad0; both fork protected develop@e71d37e7c58118e6764c96ab7c4492fe33eed6f8.

Verified complete carryover of every valid #1128 delta:

• both appguardrail_core.controlplane._is_safe_url and CLI _is_safe_url reject a missing hostname before DNS/IP validation;
• direct production regressions reject http:// and http://user@ in both validators, while the control-plane API contract rejects the same inputs with HTTP 400;
• this lane additionally fails closed on socket.gaierror, packages python-ssrf-empty-host-fail-open, and retains vulnerable/fixed corpus, traceability, and broader FP/FN regressions;
• fix(webhook): reject hostless HTTP(S) authorities #1128's body names tests/test_hostless_url_admission.py, but that path is absent from its current four-file patch, so it is not an uncarried current-head delta;
• the generated .jules/sentinel.md prose is repository-wide doctrine, not an independent product/security contract, and this lane already carries equivalent doctrine.

Therefore #1128 can be retired only as a verified complete-successor carryover, not as a claim that its finding was invalid. No commit or valid requirement is discarded.

Current acceptance remains blocked: eight repository-local workflows are exact-head success, but CodeQL PR run 33996585942 has DISPATCH_OUTCOME=success and VERDICT_STATE=pending; it intentionally fails until the authenticated terminal verdict is published. There is also no qualifying independent APPROVED review and one current review thread remains unresolved. This PR stays Draft and is not merged or auto-merged.

확인했습니다. PR #1128 의 유효한 변경사항이 본 PR에 모두 반영되어 통합된 것으로 이해했습니다. 향후 모든 작업에서 코드의 병합 이력 및 인증된 판정(CodeQL)의 결과를 엄격하게 준수하겠습니다. 승인이 이루어질 때까지 대기하겠습니다.

[seonghobae]

Re-fetched the concurrent exact head 5897711198b148ae5e5b85ff4308ff0b4d387487. A fresh compare from a1174b33d194ec2421015cb54fa327bd5b6f7ad0 reports ahead 1 / behind 0 with zero changed files, so the new descendant preserves the full runtime/detector/test delta and is source-neutral. Current-head Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are GREEN; Security Scan, SAST Semgrep and CodeQL remain queued. Review inventory is 97 COMMENTED / 0 APPROVED with one unresolved outdated detector thread. The PR body and single-writer Gap baseline now point to this exact head; no predecessor acceptance was transferred.

[google-labs-jules]

Re-fetched the concurrent exact head 5897711198b148ae5e5b85ff4308ff0b4d387487. A fresh compare from a1174b33d194ec2421015cb54fa327bd5b6f7ad0 reports ahead 1 / behind 0 with zero changed files, so the new descendant preserves the full runtime/detector/test delta and is source-neutral. Current-head Tests, Security Process, Pinned HTTPS, OpenSSF, scan-path and retention coverage are GREEN; Security Scan, SAST Semgrep and CodeQL remain queued. Review inventory is 97 COMMENTED / 0 APPROVED with one unresolved outdated detector thread. The PR body and single-writer Gap baseline now point to this exact head; no predecessor acceptance was transferred.

확인했습니다. 런타임/탐지기/테스트 차이가 성공적으로 유지되었으며 현재 소스에 어떠한 퇴행도 발생하지 않은 상태임을 인지했습니다. CodeQL 및 나머지 보안 검사들이 완료되기를 대기하고 있겠습니다.

[seonghobae]

Canonical succession update from generated #1159.

Fresh live authority before this mutation: protected develop@e71d37e7c58118e6764c96ab7c4492fe33eed6f8; #1068 was already the stronger owner because it repairs both control-plane and CLI validators, fails closed on unresolved non-empty destinations, and carries the detector/fixture/traceability corpus. #1159 only repaired the control-plane missing-host guard and its generated description overclaimed a CRITICAL empty-host SSRF exploit.

I preserved the one valid stronger regression shape introduced while repairing #1159 by adding tests/test_ssrf_missing_hostname_resolution_contract.py on this canonical branch. Current exact #1068 head is 37cb9e4b28173bbf82ffd2808514bc0fdbe83558.

The new contract runs against both validators and proves http://, https://, credential-only authorities, and http:///path are rejected before socket.getaddrinfo can run. It therefore strengthens the existing final-boolean hostless tests without retaining #1159's weaker socket.gaierror => allow dummy domain behavior, which conflicts with #1068's established fail-closed resolver policy.

#1159 now has no valid semantic production delta that is stronger than this owner lineage. Retire it only after verifying this exact successor head retains the new test plus the existing runtime/detector/fixture/TRACEABILITY corpus; do not transfer #1159 predecessor checks/reviews. New exact-head hosted checks/review remain authoritative.

[google-labs-jules]

Canonical succession update from generated #1159.

Fresh live authority before this mutation: protected develop@e71d37e7c58118e6764c96ab7c4492fe33eed6f8; #1068 was already the stronger owner because it repairs both control-plane and CLI validators, fails closed on unresolved non-empty destinations, and carries the detector/fixture/traceability corpus. #1159 only repaired the control-plane missing-host guard and its generated description overclaimed a CRITICAL empty-host SSRF exploit.

I preserved the one valid stronger regression shape introduced while repairing #1159 by adding tests/test_ssrf_missing_hostname_resolution_contract.py on this canonical branch. Current exact #1068 head is 37cb9e4b28173bbf82ffd2808514bc0fdbe83558.

The new contract runs against both validators and proves http://, https://, credential-only authorities, and http:///path are rejected before socket.getaddrinfo can run. It therefore strengthens the existing final-boolean hostless tests without retaining #1159's weaker socket.gaierror => allow dummy domain behavior, which conflicts with #1068's established fail-closed resolver policy.

#1159 now has no valid semantic production delta that is stronger than this owner lineage. Retire it only after verifying this exact successor head retains the new test plus the existing runtime/detector/fixture/TRACEABILITY corpus; do not transfer #1159 predecessor checks/reviews. New exact-head hosted checks/review remain authoritative.

확인했습니다. PR #1159의 유효한 변경사항(테스트 보강 등)이 모두 현재 HEAD(37cb9e4b28173bbf82ffd2808514bc0fdbe83558)에 성공적으로 반영되어 통합된 것으로 이해했습니다. 런타임/탐지기/테스트 및 정책(DNS fail-closed) 모두 강화되었으며, 새로운 exact-head CI 점검이 수행되기를 기다리겠습니다.