user df62dd8768 chore(mcp): SSRF guard on OAuth metadata discovery follow-up fetches ... The OAuth discovery code in mcp_server_manager followed two attacker-influenceable URLs without validation: the ``resource_metadata`` URL parsed out of a ``WWW-Authenticate`` challenge, and the ``authorization_servers[0]`` field of the PRM JSON returned by the resource server. A malicious MCP server could point those at a cloud-instance-metadata service, an internal admin panel, or a loopback debug endpoint and the proxy would issue a blind GET on its behalf. Add ``_is_safe_metadata_url(url, server_url)`` and gate both follow- up fetch sites on it. A URL is allowed when: - it shares scheme + host + port with ``server_url`` (well-known endpoints constructed from the admin's URL, and PRM published at the resource server itself per RFC 9728 §3.3), or - it resolves to publicly-routable IPs only (covers federated authorization servers — Azure Entra, Google, Okta, GitHub — hosted cross-origin from the resource server). URLs that resolve to private / loopback / link-local / cloud-metadata addresses, or that don't resolve at all, are rejected. ``http`` and ``https`` are the only schemes accepted. The IP block list is provided by the existing ``_is_blocked_ip`` helper from ``litellm_core_utils.url_utils`` so the policy stays consistent with the rest of the proxy. The guard does not protect against active DNS rebinding between this resolution and the subsequent httpx GET — the same-authority pin remains the primary mitigation; the IP check is defence in depth. The surface only triggers on config load / add-server, not per request, so the synchronous ``getaddrinfo`` is acceptable. Threads ``server_url`` through ``_fetch_oauth_metadata_from_resource``, ``_fetch_authorization_server_metadata``, and ``_fetch_single_authorization_server_metadata``. Existing tests for those helpers updated for the new signature; new ``TestOAuthDiscoverySSRFGuard`` covers same-authority allow, private-IP rejection across IPv4 and IPv6, multi-A-record dual- stack rejection, unresolvable hosts, non-http schemes, and end-to-end "no network call when guard denies".		2026-04-30 02:43:30 +00:00
..
mcp_server	chore(mcp): SSRF guard on OAuth metadata discovery follow-up fetches	2026-04-30 02:43:30 +00:00