Rip&Tear 565592c36e fix(tools): re-validate redirects and pin peer IP to close SSRF bypass ...

validate_url checked the URL string but ScrapeWebsiteTool and
ScrapeElementFromWebsiteTool then fetched with requests' default
allow_redirects=True, so a public host that 302-redirected to an
internal address reached it without re-validation. The resolved IPs
were also discarded, leaving a DNS time-of-check/time-of-use gap.

Add crewai_tools.security.safe_requests:
- SSRFProtectedAdapter re-runs validate_url on every send, including
  each redirect hop (Session.send calls the adapter per hop).
- Connections validate the actual connected peer IP at connect time,
  so the IP that was authorised is the IP that is used (closes the
  DNS-rebinding gap).

Route the two direct-fetch scrape tools through safe_get and add tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-04 22:16:19 +08:00

..

cli

fix(deps): bump pyjwt to >=2.13.0 to patch CVEs

2026-06-02 10:01:53 -07:00

crewai

Lorenze/fix/file input not working reliably (#6020)

2026-06-02 17:14:51 -07:00

crewai-core

fix(deps): bump pyjwt to >=2.13.0 to patch CVEs

2026-06-02 10:01:53 -07:00

crewai-files

Lorenze/fix/file input not working reliably (#6020)

2026-06-02 17:14:51 -07:00

crewai-tools

fix(tools): re-validate redirects and pin peer IP to close SSRF bypass

2026-06-04 22:16:19 +08:00

devtools

fix(devtools): point template bumper at lib/cli templates dir

2026-06-02 02:02:12 -07:00