starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-09-10 16:05:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

disable redirect following on AI proxy client to close SSRF (#9370)

Browse Source 
* fix(ai): disable redirect following on AI proxy client to close SSRF

The AI proxy validates the configured base_url against SSRF rules but the
shared HTTP client followed up to 10 redirects without revalidating the
hops, so a public base_url could 3xx the server into a private/internal
address (e.g. the Docker socket or cloud metadata). Disable redirect
following so the validated host is the only one the server connects to.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(ai): remove heavy redirect SSRF integration test

Drop the integration-test-level regression for redirect following; it
spins up a full API server + DB for a one-line client-config change.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ruben Fiszel
2026-05-29 04:59:47 +00:00
committed by GitHub
co-authored by Claude Opus 4.7
parent bb90f4ce83
commit 96a8eb63d4
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api/src/ai.rs
+7
View File
@@ -108,6 +108,13 @@ lazy_static::lazy_static! {
.timeout(std::time::Duration::from_secs(*AI_TIMEOUT_SECS)) .timeout(std::time::Duration::from_secs(*AI_TIMEOUT_SECS))
.pool_max_idle_per_host(HTTP_POOL_MAX_IDLE_PER_HOST) .pool_max_idle_per_host(HTTP_POOL_MAX_IDLE_PER_HOST)
.pool_idle_timeout(Some(std::time::Duration::from_secs(HTTP_POOL_IDLE_TIMEOUT_SECS))) .pool_idle_timeout(Some(std::time::Duration::from_secs(HTTP_POOL_IDLE_TIMEOUT_SECS)))
// The SSRF check in `get_base_url` only validates the configured `base_url`.
// reqwest follows up to 10 redirects by default and does not revalidate the
// hops, so a public base_url could 3xx the server into a private/internal
// address. Disable redirect following so the validated host is the only one
// we ever connect to. AI APIs respond directly and do not rely on redirects,
// so this holds even for ALLOW_PRIVATE_AI_BASE_URLS deployments.
.redirect(reqwest::redirect::Policy::none())
.user_agent("windmill/beta")) .user_agent("windmill/beta"))
.build() .build()
.expect("Failed to build AI HTTP client - check system TLS configuration"); .expect("Failed to build AI HTTP client - check system TLS configuration");