Ruben Fiszel 4b06881918 fix(ai): validate token_url for SSRF in OAuth credentials flow (#9385) ...

get_token_using_oauth resolved the AI OAuth resource's token_url and
POSTed to it without any SSRF validation, while base_url is validated in
get_base_url. A workspace member with resources:write could point
token_url at an internal/metadata address (e.g. 169.254.169.254),
turning the server into an authenticated blind SSRF probe.

Validate the resolved token_url with validate_url_for_ssrf before the
request, gated behind the same ALLOW_PRIVATE_AI_BASE_URLS opt-in as
base_url so private AI deployments keep working consistently for both
URL fields. ALLOW_PRIVATE_AI_BASE_URLS is now pub so windmill-api can
reuse it instead of re-parsing the env var.

2026-05-30 09:33:27 +00:00

..

src

fix(ai): validate token_url for SSRF in OAuth credentials flow (#9385)

2026-05-30 09:33:27 +00:00

Cargo.toml

refactor: move bedrock proxy handling to windmill-ai (#9309)

2026-05-25 14:22:10 +00:00