crawl4ai

unclecode/crawl4ai

Fork 0

mirror of https://github.com/unclecode/crawl4ai.git synced 2026-06-10 15:58:15 +00:00

Commit Graph

Author	SHA1	Message	Date
unclecode	1e25edcb5c	fix(security): block IPv6-mapped IPv4 SSRF bypass Caught during internal review. `http://[::ffff:127.0.0.1]/` bypassed validate_webhook_url because getaddrinfo returns ::ffff:7f00:1, which is not in any IPv4 blocklist (127.0.0.0/8) nor IPv6 blocklist (::1/128). Fix: added _expand_ip_candidates() helper that unwraps IPv4 from IPv4-mapped (::ffff:X.Y.Z.W, via .ipv4_mapped) and IPv4-compatible (::X.Y.Z.W, via low-32-bits) IPv6 addresses. Blocklist now checks both the original IP and the unwrapped IPv4 form. Added 6 new TestIPv6MappedBypass tests covering: - Loopback, RFC 1918, link-local (cloud metadata) via ::ffff: mapping - IPv4-compatible variant (::127.0.0.1) - Regression test that plain ::1 still blocked Also updated stale test assertion in test_eval_security_adversarial: hasattr, type, __build_class__ were removed from hook builtins in batch 2 but the test still expected hasattr to remain. DO NOT PUSH until release day.	2026-04-20 10:10:59 +00:00
unclecode	e326da9166	fix(security): complete AST sandbox escape remediation (CVSS 9.8) Addresses the gi_frame.f_back chain exploit reported by Song Binglin (q1uf3ng). - Delete _safe_eval_expression() and _SAFE_EVAL_BUILTINS entirely from extraction_strategy.py. Dead security-sensitive code is a liability. The eval path was already disabled; this removes the function itself. - Fix hook_manager.py module injection: replace broken exec("import X", ns) pattern (silently failed due to missing __import__) with direct module injection. Sanitize asyncio to strip subprocess access (RCE vector). - Add startup warning when CRAWL4AI_API_TOKEN is unset (all endpoints unauthenticated). - Expand adversarial test suite to 87 tests: hook sandbox escapes, asyncio.subprocess RCE verification, end-to-end exploit payload from vuln report, dead code deletion checks, codebase eval/exec audit.	2026-03-31 13:01:57 +00:00
unclecode	2fc39cbe89	fix(security): remove eval() from computed fields, harden config deserializer - Disable eval() in _compute_field expression path (RCE vector via untrusted input). Expression key now logs warning and returns default; function key still works. - Harden _safe_eval_config in server.py with name/attribute allowlists, block lambdas, generators, comprehensions in constructor args. - Remove getattr/setattr from hook_manager allowed builtins (sandbox escape vectors). - Add 67 adversarial security tests covering all eval/exec attack surfaces. Closes #1886, closes #1855	2026-03-31 12:02:43 +00:00

Author

SHA1

Message

Date

unclecode

1e25edcb5c

fix(security): block IPv6-mapped IPv4 SSRF bypass

Caught during internal review. `http://[::ffff:127.0.0.1]/` bypassed
validate_webhook_url because getaddrinfo returns ::ffff:7f00:1, which
is not in any IPv4 blocklist (127.0.0.0/8) nor IPv6 blocklist (::1/128).

Fix: added _expand_ip_candidates() helper that unwraps IPv4 from
IPv4-mapped (::ffff:X.Y.Z.W, via .ipv4_mapped) and IPv4-compatible
(::X.Y.Z.W, via low-32-bits) IPv6 addresses. Blocklist now checks
both the original IP and the unwrapped IPv4 form.

Added 6 new TestIPv6MappedBypass tests covering:
- Loopback, RFC 1918, link-local (cloud metadata) via ::ffff: mapping
- IPv4-compatible variant (::127.0.0.1)
- Regression test that plain ::1 still blocked

Also updated stale test assertion in test_eval_security_adversarial:
hasattr, type, __build_class__ were removed from hook builtins in
batch 2 but the test still expected hasattr to remain.

DO NOT PUSH until release day.

2026-04-20 10:10:59 +00:00

unclecode

e326da9166

fix(security): complete AST sandbox escape remediation (CVSS 9.8)

Addresses the gi_frame.f_back chain exploit reported by Song Binglin (q1uf3ng).

- Delete _safe_eval_expression() and _SAFE_EVAL_BUILTINS entirely from
  extraction_strategy.py. Dead security-sensitive code is a liability.
  The eval path was already disabled; this removes the function itself.
- Fix hook_manager.py module injection: replace broken exec("import X", ns)
  pattern (silently failed due to missing __import__) with direct module
  injection. Sanitize asyncio to strip subprocess access (RCE vector).
- Add startup warning when CRAWL4AI_API_TOKEN is unset (all endpoints
  unauthenticated).
- Expand adversarial test suite to 87 tests: hook sandbox escapes,
  asyncio.subprocess RCE verification, end-to-end exploit payload from
  vuln report, dead code deletion checks, codebase eval/exec audit.

2026-03-31 13:01:57 +00:00

unclecode

2fc39cbe89

fix(security): remove eval() from computed fields, harden config deserializer

- Disable eval() in _compute_field expression path (RCE vector via untrusted input).
  Expression key now logs warning and returns default; function key still works.
- Harden _safe_eval_config in server.py with name/attribute allowlists,
  block lambdas, generators, comprehensions in constructor args.
- Remove getattr/setattr from hook_manager allowed builtins (sandbox escape vectors).
- Add 67 adversarial security tests covering all eval/exec attack surfaces.

Closes #1886, closes #1855

2026-03-31 12:02:43 +00:00

3 Commits