langgraph-api 0.9.0.dev3__py3-none-any.whl → 0.9.0.dev4__py3-none-any.whl

langgraph_api/__init__.py

@@ -1 +1 @@
-__version__ = "0.9.0.dev3"
+__version__ = "0.9.0.dev4"

langgraph_api/config/schemas.py

@@ -386,7 +386,26 @@ class WebhookUrlPolicy(TypedDict, total=False):
     max_url_length: int
     """Maximum permitted URL length in characters; longer inputs are rejected early."""
     disable_loopback: bool
-    """Disallow relative URLs (internal loopback calls) and localhost hostnames when true."""
+    """Disallow loopback-flavored webhook targets when true. Defaults to true.
+
+    Covers all of:
+    - Relative URLs (e.g. ``/internal/hook``) that would dispatch via the
+      in-process ASGI loopback transport at ``root_path="/noauth"``. These
+      bypass authentication and were the auth-bypass primitive behind
+      GHSA-q3v5-r5ch-p57j.
+    - Absolute URLs whose hostname is ``localhost`` / ``localhost.localdomain``
+      / ``host.docker.internal``.
+    - Absolute URLs that DNS-resolve into the IPv4 loopback range
+      (``127.0.0.0/8``) or IPv6 loopback (``::1/128``) — including
+      DNS-rebinding-style attacks where an arbitrary hostname resolves to
+      a loopback IP.
+
+    Operators who intentionally route webhooks to in-process routes
+    (e.g. for local development with ``langgraph dev``, or single-host
+    docker-compose setups dispatching to ``host.docker.internal``) can
+    set this to ``false`` to restore the pre-GHSA behavior. Only do this
+    when you control all routes that loopback webhooks can reach.
+    """
     disable_private_ips: bool
     """Block RFC 1918 / CGN private IP ranges as webhook targets when true.
 
@@ -426,7 +445,12 @@ def _validate_url_policy(
     if "max_url_length" not in policy:
         policy["max_url_length"] = 2048
     if "disable_loopback" not in policy:
-        policy["disable_loopback"] = False
+        # Secure default — covers GHSA-q3v5-r5ch-p57j (relative-URL ASGI
+        # loopback auth bypass) and the broader SSRF surface that the same
+        # flag governs via SSRFPolicy.block_localhost. Mirrored at the
+        # webhook.py read site so deployments without any webhooks block
+        # also get the safe default.
+        policy["disable_loopback"] = True
     if "disable_private_ips" not in policy:
         policy["disable_private_ips"] = False
     return policy

langgraph_api/webhook.py

@@ -79,7 +79,14 @@ def _get_webhook_config() -> _WebhookConfig:
     exact_allowed = frozenset(exact_hosts)
 
     disable_private_ips = bool(policy_cfg.get("disable_private_ips", False))
-    disable_loopback = bool(policy_cfg.get("disable_loopback", False))
+    # Loopback webhooks are denied by default (covers relative URLs that
+    # would dispatch through the in-process ASGI client at root_path=/noauth,
+    # plus localhost / 127.x / ::1 / host.docker.internal absolute URLs,
+    # plus any hostname that DNS-resolves into the loopback range). This is
+    # the fix for GHSA-q3v5-r5ch-p57j: relative-URL webhooks were the auth
+    # bypass primitive, and the localhost/loopback IP variants are the
+    # broader SSRF surface that the same flag governs via SSRFPolicy.
+    disable_loopback = bool(policy_cfg.get("disable_loopback", True))
 
     return _WebhookConfig(
         allowed_domains=allowed_domains,
@@ -111,11 +118,26 @@ async def validate_webhook_url_or_raise(url: str) -> None:
     if len(url) > wh.max_url_length:
         raise HTTPException(status_code=422, detail="Webhook URL too long")
 
-    # Relative loopback URL (internal route) — not subject to SSRF checks
+    # Relative loopback URL (internal route) — dispatched via an in-process
+    # ASGI client that mounts under root_path="/noauth", which the auth
+    # middleware treats as an auth-bypass marker. Denied by default so a
+    # user-supplied webhook URL cannot be turned into an unauthenticated
+    # call against the server's own routes (GHSA-q3v5-r5ch-p57j). Operators
+    # who intentionally route webhooks to in-process routes can opt back in
+    # by setting webhooks.url.disable_loopback to false.
     if url.startswith("/"):
         if wh.disable_loopback:
             raise HTTPException(
-                status_code=422, detail="Loopback webhooks are disabled"
+                status_code=422,
+                detail=(
+                    "Loopback webhooks (relative URLs and localhost) are "
+                    "disabled by default. They bypass authentication via the "
+                    "in-process ASGI transport and can be abused to invoke "
+                    "internal routes as an unauthenticated caller. Set "
+                    "webhooks.url.disable_loopback to false (in langgraph.json "
+                    "or via LANGGRAPH_WEBHOOKS) to opt back in — only do so "
+                    "when you control the mounted routes."
+                ),
             )
         return
 

{langgraph_api-0.9.0.dev3.dist-info → langgraph_api-0.9.0.dev4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.9.0.dev3
+Version: 0.9.0.dev4
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE

{langgraph_api-0.9.0.dev3.dist-info → langgraph_api-0.9.0.dev4.dist-info}/RECORD

@@ -1,4 +1,4 @@
-langgraph_api/__init__.py,sha256=rT-z7MS6SjjAW-hNfa1lcceqLHtmubGcbZwqU32848M,27
+langgraph_api/__init__.py,sha256=etrMz_KrjnLluOQExvb90dAxp4ASQ-MKozOsxgHwg8A,27
 langgraph_api/_factory_utils.py,sha256=5JsiJbg_YocVSryN2jwoZTg03-eyymlWMK6sKCmXwz0,5756
 langgraph_api/asgi_transport.py,sha256=XApY3lIWBZTMbbsl8dDJzl0cLGirmAGE0SifqZUnXvs,11896
 langgraph_api/asyncio.py,sha256=c-YE-14N7_AP1GzifsbP14XnhLsmxT2P916KXruerpI,10573
@@ -32,7 +32,7 @@ langgraph_api/stream.py,sha256=W9lrfDWXmCRDLyF_7s2846DNG_b9_-ijoHEUmW-x990,30346
 langgraph_api/stream_v2.py,sha256=gW98dq9HKsCJ2NxmXzsYGcqBwFH2bSgmoFVNN3aVPOs,9897
 langgraph_api/traceblock.py,sha256=GhgAtLhAQ8Z8LHtRQq3par-rfPpRBQp2Q7WBACJq1NI,677
 langgraph_api/validation.py,sha256=XyeKyt7jAICmIlT_b0J0mv2YbwIbNoe4m6zEmfk9gOA,14657
-langgraph_api/webhook.py,sha256=pmgiy1lqTveG8XuE5XLG5dLw7Y5P_AsvewYc7FeGV0c,8100
+langgraph_api/webhook.py,sha256=qXEtkE6orek2POeOQmPRsEarJgXIYp-LBrZB-OwITxc,9572
 langgraph_api/worker.py,sha256=gixTe6SLYqSEARri_Lbii6cT69dMM0iwDC7YKgYgx5E,21160
 langgraph_api/_checkpointer/__init__.py,sha256=ofJTJLGy7Hsuzhj-2dpfDvrDloM0BzlhTzvZOdR9K8U,2223
 langgraph_api/_checkpointer/_adapter.py,sha256=1Mdb3B_bg6EQ_3uJfk6ImiobIiAPdaMQVaruDBzVkE8,20833
@@ -65,7 +65,7 @@ langgraph_api/auth/langsmith/backend.py,sha256=Y6-VxD7zfV1jzGdjmQ66CgNa3SenLbo3d
 langgraph_api/auth/langsmith/client.py,sha256=79kwCVeHU64nsHsxWipfZhf44lM6vfs2nlfTxlJF6LU,4142
 langgraph_api/config/__init__.py,sha256=hGqZ3_B4wPm3ZuH5wrDFHHBmtOH_qYnFvX9ChmsBNZ8,25159
 langgraph_api/config/_parse.py,sha256=VXQPKzqtIsZrRy-nUEBMDESBxXzqFRQNiqsvAZeX3HU,3921
-langgraph_api/config/schemas.py,sha256=QLaJXr-q2KuVUcD-ODcnMRorek1UJbbSfWL0Oi9MzJY,19580
+langgraph_api/config/schemas.py,sha256=rYqu67fZxmtCOU-Zc1s3265KbRbqK8PmfvfwvrAmd-Q,20863
 langgraph_api/encryption/__init__.py,sha256=gaCZ00CocSbqSqrDn6XJHaSp2CZCnC8qnrD9G4fbzyI,363
 langgraph_api/encryption/aes_json.py,sha256=ExLgrthzVYGP4X51TStU2Td_Sn_3-kXHyk6UKTFmzW4,6139
 langgraph_api/encryption/context.py,sha256=twnDvH3FcC8rlnPOAhI09dLZcxGgMVlplIH2ZpJ-8P4,1121
@@ -228,8 +228,8 @@ langgraph_grpc_common/proto/errors_pb2.py,sha256=JI6x-vBK1AE7DHZ5DQwN1mZWF6C4xTR
 langgraph_grpc_common/proto/errors_pb2.pyi,sha256=rd3-BYUH8V-aO66taL7OOblaLgdrDtf1Vcd38GUoVVM,2181
 langgraph_grpc_common/proto/errors_pb2_grpc.py,sha256=2-LwQ0OPGo-NtC0269q7Fw6GPBxnTLYWq3xP5Eq0_YA,886
 langgraph_grpc_common/proto/errors_pb2_grpc.pyi,sha256=uC9Wnq6uyg488QiONpJ0ba1s_iouQCOYsjd_FDd1XUM,495
-langgraph_api-0.9.0.dev3.dist-info/METADATA,sha256=uSDwXIVruhpFKitSJeLY0GYBNIMLEobchCCAap1Vux8,4516
-langgraph_api-0.9.0.dev3.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-langgraph_api-0.9.0.dev3.dist-info/entry_points.txt,sha256=hGedv8n7cgi41PypMfinwS_HfCwA7xJIfS0jAp8htV8,78
-langgraph_api-0.9.0.dev3.dist-info/licenses/LICENSE,sha256=ZPwVR73Biwm3sK6vR54djCrhaRiM4cAD2zvOQZV8Xis,3859
-langgraph_api-0.9.0.dev3.dist-info/RECORD,,
+langgraph_api-0.9.0.dev4.dist-info/METADATA,sha256=g_Fq02B-NpB42hrXkLYufVw6c2jlw3s-u-7GE3tfNog,4516
+langgraph_api-0.9.0.dev4.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+langgraph_api-0.9.0.dev4.dist-info/entry_points.txt,sha256=hGedv8n7cgi41PypMfinwS_HfCwA7xJIfS0jAp8htV8,78
+langgraph_api-0.9.0.dev4.dist-info/licenses/LICENSE,sha256=ZPwVR73Biwm3sK6vR54djCrhaRiM4cAD2zvOQZV8Xis,3859
+langgraph_api-0.9.0.dev4.dist-info/RECORD,,