From 96a8eb63d449d29653d8d2c08cdfab4dd79a9ce6 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Fri, 29 May 2026 06:59:47 +0200 Subject: [PATCH] disable redirect following on AI proxy client to close SSRF (#9370) * fix(ai): disable redirect following on AI proxy client to close SSRF The AI proxy validates the configured base_url against SSRF rules but the shared HTTP client followed up to 10 redirects without revalidating the hops, so a public base_url could 3xx the server into a private/internal address (e.g. the Docker socket or cloud metadata). Disable redirect following so the validated host is the only one the server connects to. Co-Authored-By: Claude Opus 4.7 (1M context) * test(ai): remove heavy redirect SSRF integration test Drop the integration-test-level regression for redirect following; it spins up a full API server + DB for a one-line client-config change. Co-Authored-By: Claude Opus 4.7 (1M context) --------- Co-authored-by: Claude Opus 4.7 (1M context) --- backend/windmill-api/src/ai.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/backend/windmill-api/src/ai.rs b/backend/windmill-api/src/ai.rs index 21059df18a..3196c9df0c 100644 --- a/backend/windmill-api/src/ai.rs +++ b/backend/windmill-api/src/ai.rs @@ -108,6 +108,13 @@ lazy_static::lazy_static! { .timeout(std::time::Duration::from_secs(*AI_TIMEOUT_SECS)) .pool_max_idle_per_host(HTTP_POOL_MAX_IDLE_PER_HOST) .pool_idle_timeout(Some(std::time::Duration::from_secs(HTTP_POOL_IDLE_TIMEOUT_SECS))) + // The SSRF check in `get_base_url` only validates the configured `base_url`. + // reqwest follows up to 10 redirects by default and does not revalidate the + // hops, so a public base_url could 3xx the server into a private/internal + // address. Disable redirect following so the validated host is the only one + // we ever connect to. AI APIs respond directly and do not rely on redirects, + // so this holds even for ALLOW_PRIVATE_AI_BASE_URLS deployments. + .redirect(reqwest::redirect::Policy::none()) .user_agent("windmill/beta")) .build() .expect("Failed to build AI HTTP client - check system TLS configuration");