Summary

Details

def get ref body(self, resolved ref: str) -> dict[str, YamlValue]:
  if is url(resolved ref):
    if not resolved ref.startswith("file://") and self.http local ref path is None:
      if self.allow remote refs is False:
        raise Error(f"Fetching remote $ref is disabled: {resolved ref}...")
      if self.allow remote refs is None:
        warn deprecated(              # (A) warn only
          "behavior.remote-ref-default",
          details=f"Reference: {resolved ref}",
          stacklevel=2,
        )
    return self. get ref body from url(resolved ref)  # (B) fetch fires
  return self. get ref body from remote(resolved ref)

• (A) emits a deprecation warning when allow remote refs is its default (None); execution falls through to (B).
• (B) routes the URL through get text from url → get body, the same fetcher described in other report — no IP validation, redirects followed.

PoC

Impact

1. Trojaned OpenAPI document. A public REST API publishes openapi.yaml. One $ref points at http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>; running datamodel-codegen against the spec from an EC2 instance leaks the IAM credentials into the generated client.
2. Customer-supplied JSON Schema. A B2B SaaS auto-generates client code from customer-uploaded schemas. The customer adds an HTTP $ref to http://internal-admin:8080/users.json; the response (e.g. JSON user list) ends up in the generated Python the SaaS hands back to the customer.
3. CI on a private network. A PR adds schemas/inbound.json with an HTTP $ref pointed at a service reachable only from the CI cluster's VPC; the CI runner fetches it and the generated .py leaks the response in PR artifacts.

1. Flip the default in parser/base.py: allow remote refs: bool = False, and remove the silent-fetch-with-warning fallback at parser/jsonschema.py:4786-4791.
2. When fetching is allowed, apply the same IP/host validation proposed for other submitted SSRF report to both the initial $ref URL and every redirect target.
3. Document HTTP $ref in a third-party schema as equivalent to running curl on the developer's host.

Maintainer resolution