From 2fac78e8ed6ad038bcf4dc945cb90bfc307389cf Mon Sep 17 00:00:00 2001 From: Rishi Gupta Date: Wed, 21 Oct 2026 22:28:45 +0530 Subject: [PATCH] fix(security): reject embedded URL credentials --- graphify/security.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/graphify/security.py b/graphify/security.py index a2361171a..2ca4526f1 100644 --- a/graphify/security.py +++ b/graphify/security.py @@ -115,6 +115,9 @@ def validate_url(url: str) -> str: f"Got: {url!r}" ) + if parsed.username is not None or parsed.password is not None: + raise ValueError(f"Blocked URL containing embedded credentials. Got: {url!r}") + hostname = parsed.hostname if hostname: # Block known cloud metadata hostnames