From 822fbb04c23d17fe6b2c2e5198e9797e34308d84 Mon Sep 17 00:00:00 2001 From: Rishi Gupta Date: Wed, 21 Oct 2026 22:28:45 +0530 Subject: [PATCH] fix(security): reject embedded URL credentials (cherry picked from commit 2fac78e8ed6ad038bcf4dc945cb90bfc307389cf) --- graphify/security.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/graphify/security.py b/graphify/security.py index 2ed5351c7..0fe0ce7a1 100644 --- a/graphify/security.py +++ b/graphify/security.py @@ -115,6 +115,9 @@ def validate_url(url: str) -> str: f"Got: {url!r}" ) + if parsed.username is not None or parsed.password is not None: + raise ValueError(f"Blocked URL containing embedded credentials. Got: {url!r}") + try: port = parsed.port except ValueError as exc: