From 55a4fbcddcdec284fa9b49626bc20520eb27d662 Mon Sep 17 00:00:00 2001 From: Rishi Gupta Date: Wed, 21 Oct 2026 22:28:24 +0530 Subject: [PATCH] fix(security): reject malformed URL ports --- graphify/security.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/graphify/security.py b/graphify/security.py index a2361171a..2c06a593a 100644 --- a/graphify/security.py +++ b/graphify/security.py @@ -115,6 +115,13 @@ def validate_url(url: str) -> str: f"Got: {url!r}" ) + try: + port = parsed.port + except ValueError as exc: + raise ValueError(f"Blocked URL with an invalid port. Got: {url!r}") from exc + if port == 0: + raise ValueError(f"Blocked URL with port 0. Got: {url!r}") + hostname = parsed.hostname if hostname: # Block known cloud metadata hostnames