From bf8a89a924713448be167c2fc5b1e7b4d949a413 Mon Sep 17 00:00:00 2001
From: qbit-mirror-bot <qbit-mirror-bot@users.noreply.github.com>
Date: Wed, 1 Jul 2026 07:27:54 +0000
Subject: [PATCH] fix(security): add URL safety check to image_ref fetch in
 openai image_gen (SSRF)

---
 plugins/image_gen/openai/__init__.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/plugins/image_gen/openai/__init__.py b/plugins/image_gen/openai/__init__.py
index e214271bcd968..b9023be45947b 100644
--- a/plugins/image_gen/openai/__init__.py
+++ b/plugins/image_gen/openai/__init__.py
@@ -132,6 +132,12 @@ def _load_image_bytes(ref: str) -> Tuple[bytes, str]:
     ref = ref.strip()
     lower = ref.lower()
     if lower.startswith(("http://", "https://")):
+        from tools.url_safety import is_safe_url
+
+        if not is_safe_url(ref):
+            raise ValueError(
+                f"Refusing to fetch image from unsafe URL: {ref}"
+            )
         import requests
 
         resp = requests.get(ref, timeout=60)