* 🚨 Severity: CRITICAL
* 💡 Vulnerability: When instantiating `httpx.AsyncClient` in `app/api/url_upload.py`, the `event_hooks` dictionary for the "response" key was assigned twice. The second assignment (`event_hooks={"response": [verify_redirect]}`) overwrote the first (`event_hooks={"response": [validate_redirect]}`). This caused the `validate_redirect` hook to be ignored, degrading the SSRF protection mechanism on redirects.
* 🎯 Impact: Bypassing SSRF protection on HTTP redirects could allow an attacker to make the application issue arbitrary HTTP requests to internal networks or external resources.
* 🔧 Fix: Combined the two event hooks into a single list assignment `event_hooks={"response": [validate_redirect, verify_redirect]}` when instantiating the HTTP client. Added tests to ensure all lines in the modified branch are fully covered.
* ✅ Verification: Verified using the test suite. All tests pass successfully.
Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
google-labs-jules[bot]
241e57e220