fix(security): add URL safety check to image_ref fetch in openai image_gen (SSRF)

[AlexFucuson9]

Problem (P1 Security — SSRF)

The _load_image_bytes() function in plugins/image_gen/openai/__init__.py fetches arbitrary URLs passed via the ref parameter from model tool calls without any URL safety validation:

resp = requests.get(ref, timeout=60)  # ref is model-supplied, no validation

A model-supplied URL can point to:

• Cloud metadata endpoints (http://169.254.169.254/latest/meta-data/...) — leaks AWS/GCP/Azure credentials
• Internal network addresses (http://10.0.0.1:8080/admin) — scans/exfiltrates internal services
• Localhost services (http://127.0.0.1:6379/) — accesses Redis, databases, etc.

This is a server-side request forgery (SSRF) vulnerability through the gateway process.

Fix

Add is_safe_url() check from tools.url_safety before fetching, matching the pattern already used in:

• tools/vision_tools.py:212 — image URL validation
• tools/web_tools.py:100 — web search URL validation
• tools/skills_hub.py:40 — skill URL validation
• plugins/platforms/slack/adapter.py:1646 — Slack attachment validation
• plugins/platforms/mattermost/adapter.py:500 — Mattermost attachment validation

Scope

Only the openai image_gen plugin fetches user-supplied URLs via ref. Other image_gen plugins (krea, xai, openrouter) only call their respective API endpoints with server-controlled URLs — no SSRF risk.

Testing

• python3 -m py_compile plugins/image_gen/openai/__init__.py — OK
• The is_safe_url function blocks private IPs (10.x, 172.16-31.x, 192.168.x), link-local (169.254.x), localhost, and metadata endpoints

Ref: #54553 (previous SSRF fix attempt, not merged)

[alt-glitch]

This was generated by AI during triage.

Duplicate of #54553 — that earlier open PR adds the identical is_safe_url() SSRF guard to the same _load_image_bytes() branch in plugins/image_gen/openai/__init__.py (only the error-message string differs). Consolidating on #54553 as the canonical fix. Related SSRF work on the provider-returned-URL path lives in #45537 / #44743 (issue #44728), a different code site.

[teknium1]

Thanks for addressing the unguarded OpenAI image-reference fetch; current main still has the direct requests.get(ref, timeout=60) path at plugins/image_gen/openai/__init__.py:134-140.

Problems

• The new initial is_safe_url(ref) check does not cover redirects. requests.get() follows redirects by default, so a public URL can redirect to a metadata/private address. tools/vision_tools.py:405-417 documents this exact bypass and re-validates every redirect target.
• The PR changes no tests. tests/plugins/image_gen/test_openai_provider.py:127-186 currently covers local-file and data-URI loading only, not URL or redirect SSRF behavior.

Suggested changes

• Validate every redirect hop (or use a redirect-safe downloader) rather than only the initial URL.
• Add mocked direct-unsafe-URL and public-to-private-redirect regression tests.

Automated hermes-sweeper review.

[teknium1]

requests.get() follows redirects by default, so this only validates the first hop. A public URL can still redirect to a metadata/private address; validate every redirect target before issuing its request, as tools/vision_tools.py:405-417 does.