From b5ed16c1c8d0a678225f5acd3eea7942a07ae805 Mon Sep 17 00:00:00 2001 From: "google-labs-jules[bot]" <161369871+google-labs-jules[bot]@users.noreply.github.com> Date: Sun, 22 Mar 2026 03:58:07 +0000 Subject: [PATCH] Security: Replace urllib.request with httpx in WebDAV testing The `_test_webdav_connection` function previously used `urllib.request.urlopen` to verify connection credentials. This triggers a Bandit B310 warning because `urllib` supports multiple schemes (like file://, ftp://) and implicitly follows redirects. Although scheme checking and a basic `is_private_ip` validation were implemented, using `urllib.request` remains risky because a public URL could return an HTTP redirect to a private IP (e.g., 127.0.0.1) which `urllib` would blindly follow, causing an SSRF (Server-Side Request Forgery) bypass. This commit replaces `urllib.request` with `httpx.request` using explicitly `follow_redirects=False`. This eliminates the B310 vulnerability, ensures requests only hit the specified URL without following potentially malicious redirects, and standardizes the application on `httpx` for safer HTTP connections. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> --- .jules/sentinel.md | 4 ++++ app/api/integrations.py | 19 ++++++++----------- 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/.jules/sentinel.md b/.jules/sentinel.md index 7833fd12..fa35a57f 100644 --- a/.jules/sentinel.md +++ b/.jules/sentinel.md @@ -2,3 +2,7 @@ **Vulnerability:** The `_test_webdav_connection` function had a custom SSRF check that failed to resolve DNS names, allowing attackers to bypass the check by providing a domain that resolves to an internal IP (e.g., `127.0.0.1`). **Learning:** DNS resolution is required for robust SSRF protection when validating URLs provided by users. **Prevention:** Use a centralized `is_private_ip` function (now in `app/utils/network.py`) that resolves the hostname to its IPs and checks if any are private. +## 2026-03-22 - B310: urllib.request.urlopen replaced with httpx +**Vulnerability:** The `_test_webdav_connection` function used `urllib.request.urlopen`, which natively supports dangerous schemes like `file://` or `ftp://` and follows redirects by default, potentially allowing SSRF bypasses or Local File Inclusion. +**Learning:** `urllib.request` should be avoided for user-supplied URLs. Even when URL schemes are manually validated, `urllib`'s default redirect following behavior can bypass SSRF protections (e.g. redirecting to `127.0.0.1`). +**Prevention:** Use a modern, safer HTTP client like `httpx` with `follow_redirects=False` when testing user-provided URLs. diff --git a/app/api/integrations.py b/app/api/integrations.py index c0d58893..f5b11a16 100644 --- a/app/api/integrations.py +++ b/app/api/integrations.py @@ -608,7 +608,7 @@ def _test_dropbox_connection(config: dict[str, Any] | None, credentials: dict[st def _test_webdav_connection(config: dict[str, Any] | None, credentials: dict[str, Any] | None) -> dict[str, Any]: """Test a WebDAV/Nextcloud connection by issuing an HTTP PROPFIND.""" - import urllib.request + import httpx cfg = config or {} creds = credentials or {} @@ -635,17 +635,14 @@ def _test_webdav_connection(config: dict[str, Any] | None, credentials: dict[str return {"success": False, "message": "URLs pointing to internal or private networks are not allowed"} try: - import base64 + auth = (username, password) if username and password else None + headers = {"Depth": "0"} - req = urllib.request.Request(url, method="PROPFIND") # noqa: S310 - if username and password: - token = base64.b64encode(f"{username}:{password}".encode()).decode() - req.add_header("Authorization", f"Basic {token}") - req.add_header("Depth", "0") - with urllib.request.urlopen(req, timeout=10) as resp: # noqa: S310 - if resp.status < 400: - return {"success": True, "message": "WebDAV connection successful"} - return {"success": False, "message": f"WebDAV returned HTTP {resp.status}"} + # Use httpx for secure connection testing, avoiding urllib vulnerabilities + resp = httpx.request("PROPFIND", url, auth=auth, headers=headers, timeout=10.0, follow_redirects=False) + if resp.status_code < 400: + return {"success": True, "message": "WebDAV connection successful"} + return {"success": False, "message": f"WebDAV returned HTTP {resp.status_code}"} except Exception as exc: # noqa: BLE001 logger.warning("WebDAV connection error for %s: %s", hostname, exc) return {"success": False, "message": "WebDAV connection failed — check URL and credentials"}