From 724a184bdda798484de7794e936404574468d00f Mon Sep 17 00:00:00 2001 From: Rishi Gupta Date: Wed, 21 Oct 2026 22:24:57 +0530 Subject: [PATCH] fix(security): reject HTTP URLs without a hostname (cherry picked from commit 6f4782affa187e02ef32a88cee4c451bfb49daee) --- graphify/security.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/graphify/security.py b/graphify/security.py index a2361171a..fe1c66c2c 100644 --- a/graphify/security.py +++ b/graphify/security.py @@ -116,6 +116,9 @@ def validate_url(url: str) -> str: ) hostname = parsed.hostname + if not hostname: + raise ValueError(f"Blocked URL without a hostname. Got: {url!r}") + if hostname: # Block known cloud metadata hostnames if hostname.lower() in _BLOCKED_HOSTS: