chatflow-agent 0.3.2__tar.gz → 0.3.3__tar.gz

{chatflow_agent-0.3.2 → chatflow_agent-0.3.3}/.github/workflows/publish.yml

@@ -3,9 +3,6 @@ name: Publish to PyPI
 on:
   release:
     types: [published]
-  push:
-    tags:
-      - "v*"
 
 jobs:
   build-and-publish:

{chatflow_agent-0.3.2 → chatflow_agent-0.3.3}/CHANGELOG.md

@@ -14,6 +14,11 @@ Versioning / Versionado: [Semantic Versioning](https://semver.org/spec/v2.0.0.ht
 
 ## [Unreleased]
 
+## [0.3.3] - 2026-10-19
+
+### Security
+- **Strict Local Endpoint Hostname Validation:** `OpenAIEngine` now validates `base_url` structure, HTTP/HTTPS scheme, port range, and parsed hostname via `urllib.parse.urlsplit` when identifying local endpoints (`localhost`, `127.0.0.1`, `::1`, and local bind compatibility address `0.0.0.0`), replacing substring matching (Issue #74).
+
 ## [0.3.2] - 2026-09-29
 
 ### Security
@@ -69,6 +74,11 @@ If you are upgrading from v0.2.0:
 
 ## [Unreleased]
 
+## [0.3.3] - 2026-10-19
+
+### Seguridad
+- **Validación Estricta de Hostname en Endpoints Locales:** `OpenAIEngine` ahora valida la estructura de `base_url`, el esquema HTTP/HTTPS, el rango de puerto y el hostname real mediante `urllib.parse.urlsplit` al identificar endpoints locales (`localhost`, `127.0.0.1`, `::1` y la dirección de compatibilidad local `0.0.0.0`), reemplazando la coincidencia por subcadenas (Issue #74).
+
 ## [0.3.2] - 2026-09-29
 
 ### Seguridad

{chatflow_agent-0.3.2 → chatflow_agent-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: chatflow-agent
-Version: 0.3.2
+Version: 0.3.3
 Summary: Lightweight, async multi-agent framework with native handoffs for Gemini, Gemma, Grok, OpenAI & Claude.
 Project-URL: Homepage, https://github.com/GustavoBaranda/chatflow-agent
 Project-URL: Source Code, https://github.com/GustavoBaranda/chatflow-agent

{chatflow_agent-0.3.2 → chatflow_agent-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "chatflow-agent"
-version = "0.3.2"
+version = "0.3.3"
 description = "Lightweight, async multi-agent framework with native handoffs for Gemini, Gemma, Grok, OpenAI & Claude."
 readme = "README.md"
 requires-python = ">=3.10"

{chatflow_agent-0.3.2 → chatflow_agent-0.3.3}/src/chatflow_agent/__init__.py

@@ -34,7 +34,7 @@ from chatflow_agent.types import (
 # Alias for semantic consistency
 BaseSessionContext = SessionContext
 
-__version__ = "0.3.2"
+__version__ = "0.3.3"
 __all__ = [
     "__version__",
     "Agent",

{chatflow_agent-0.3.2 → chatflow_agent-0.3.3}/src/chatflow_agent/core/engines/openai_compatible.py

@@ -10,6 +10,7 @@ import json
 import logging
 import os
 from typing import TYPE_CHECKING, Any
+from urllib.parse import urlsplit
 
 import httpx
 
@@ -22,6 +23,28 @@ logger = logging.getLogger("chatflow_agent.engine.openai")
 if TYPE_CHECKING:
     from chatflow_agent.core.agent import Agent
 
+_LOOPBACK_HOSTS: frozenset[str] = frozenset({"localhost", "127.0.0.1", "::1"})
+# Explicit compatibility exception for local dev servers bound to 0.0.0.0 (not a loopback address)
+_COMPAT_LOCAL_BIND_HOSTS: frozenset[str] = frozenset({"0.0.0.0"})
+
+
+def _is_local_base_url(base_url: str) -> bool:
+    """Return True only when base_url is a well-formed HTTP(S) URL targeting a local host."""
+    try:
+        parsed = urlsplit(base_url)
+        _ = parsed.port
+    except ValueError:
+        return False
+
+    if parsed.scheme.lower() not in ("http", "https") or not parsed.netloc:
+        return False
+    if parsed.username is not None or parsed.password is not None:
+        return False
+
+    hostname = (parsed.hostname or "").lower().rstrip(".")
+    return hostname in _LOOPBACK_HOSTS or hostname in _COMPAT_LOCAL_BIND_HOSTS
+
+
 # Preset configurations for common OpenAI-compatible providers
 PROVIDER_PRESETS: dict[str, dict[str, str]] = {
     "openai": {
@@ -100,9 +123,7 @@ class OpenAIEngine(BaseEngine):
             p["base_url"].rstrip("/") for p in PROVIDER_PRESETS.values()
         }
         is_official = self.base_url in official_base_urls
-        is_local = any(
-            host in self.base_url for host in ("localhost", "127.0.0.1", "0.0.0.0")
-        )
+        is_local = _is_local_base_url(self.base_url)
 
         env_key_name = preset.get("env_key", "OPENAI_API_KEY")
 

{chatflow_agent-0.3.2 → chatflow_agent-0.3.3}/tests/test_multi_engine.py

@@ -279,6 +279,102 @@ def test_custom_base_url_rejects_fallback_to_global_api_key(monkeypatch: pytest.
     assert engine_official.api_key == "sk-secret-prod-key-12345"
 
 
+@pytest.mark.parametrize(
+    "spoofed_or_malformed_url",
+    [
+        "https://localhost.untrusted.example.com/v1",
+        "https://sub.localhost.example.com/v1",
+        "https://my-localhost.example.com/v1",
+        "https://untrusted.example.com/localhost/v1",
+        "https://untrusted.example.com/v1?origin=localhost",
+        "https://localhost@untrusted.example.com/v1",
+        "http://user:pass@localhost:11434/v1",
+        "https://127.0.0.1.untrusted.example.com/v1",
+        "https://untrusted.example.com/127.0.0.1/v1",
+        "https://0.0.0.0.untrusted.example.com/v1",
+        "ftp://localhost:11434/v1",
+        "localhost:11434/v1",
+        "http:///localhost/v1",
+        "http://[::1:11434/v1",
+        "http://localhost:badport/v1",
+        "http://localhost:99999/v1",
+    ],
+)
+def test_spoofed_or_malformed_local_base_url_is_rejected(
+    monkeypatch: pytest.MonkeyPatch, spoofed_or_malformed_url: str
+) -> None:
+    """External or malformed URLs containing local substrings must not bypass SEC-07 or leak env keys."""
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-secret-prod-key")
+    monkeypatch.setenv("OLLAMA_API_KEY", "ollama-secret-token")
+
+    for provider in ("openai", "ollama", "gemma"):
+        with pytest.raises(ValueError, match="A custom or unofficial base_url was provided"):
+            OpenAIEngine(provider=provider, base_url=spoofed_or_malformed_url)
+
+
+@pytest.mark.parametrize(
+    "spoofed_url",
+    [
+        "https://localhost.untrusted.example.com/v1",
+        "https://untrusted.example.com/localhost/v1",
+        "https://127.0.0.1.untrusted.example.com/v1",
+        "https://0.0.0.0.untrusted.example.com/v1",
+        "https://localhost@untrusted.example.com/v1",
+    ],
+)
+def test_spoofed_local_base_url_from_env_vars_is_rejected(
+    monkeypatch: pytest.MonkeyPatch, spoofed_url: str
+) -> None:
+    """Spoofed URLs provided via OPENAI_BASE_URL or OLLAMA_BASE_URL without explicit base_url must be rejected."""
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-secret-prod-key")
+    monkeypatch.setenv("OLLAMA_API_KEY", "ollama-secret-token")
+
+    monkeypatch.setenv("OPENAI_BASE_URL", spoofed_url)
+    with pytest.raises(ValueError, match="A custom or unofficial base_url was provided"):
+        OpenAIEngine(provider="openai")
+
+    monkeypatch.setenv("OLLAMA_BASE_URL", spoofed_url)
+    with pytest.raises(ValueError, match="A custom or unofficial base_url was provided"):
+        OpenAIEngine(provider="ollama")
+
+
+@pytest.mark.parametrize(
+    "local_url",
+    [
+        "http://localhost:11434/v1",
+        "http://LOCALHOST:11434/v1/",
+        "http://localhost.:11434/v1",
+        "https://localhost:8443/v1",
+        "http://127.0.0.1:11434/v1",
+        "http://[::1]:11434/v1",
+        "http://0.0.0.0:8000/v1",
+    ],
+)
+def test_valid_local_base_urls_are_accepted_and_protect_cloud_keys(
+    monkeypatch: pytest.MonkeyPatch, local_url: str
+) -> None:
+    """Valid loopback (localhost, 127.0.0.1, ::1) and compatibility 0.0.0.0 URLs work without leaking cloud keys."""
+    monkeypatch.setenv("OPENAI_API_KEY", "sk-secret-prod-key")
+    monkeypatch.delenv("OLLAMA_API_KEY", raising=False)
+
+    # provider='openai' pointed at local server must NOT leak OPENAI_API_KEY
+    engine_openai = OpenAIEngine(provider="openai", base_url=local_url)
+    assert engine_openai.api_key == "ollama"
+
+    # provider='ollama' / 'gemma' without OLLAMA_API_KEY defaults to 'ollama'
+    engine_ollama = OpenAIEngine(provider="ollama", base_url=local_url)
+    assert engine_ollama.api_key == "ollama"
+    engine_gemma = OpenAIEngine(provider="gemma", base_url=local_url)
+    assert engine_gemma.api_key == "ollama"
+
+    # provider='ollama' / 'gemma' with OLLAMA_API_KEY honors it on genuine local URLs
+    monkeypatch.setenv("OLLAMA_API_KEY", "local-ollama-token")
+    engine_ollama_auth = OpenAIEngine(provider="ollama", base_url=local_url)
+    assert engine_ollama_auth.api_key == "local-ollama-token"
+    engine_gemma_auth = OpenAIEngine(provider="gemma", base_url=local_url)
+    assert engine_gemma_auth.api_key == "local-ollama-token"
+
+
 @pytest.mark.asyncio
 async def test_anthropic_retry_on_529_overloaded() -> None:
     """Test AnthropicEngine retries on HTTP 529 Overloaded and succeeds."""