langgraph-api 0.9.0.dev3__tar.gz → 0.9.0.dev4__tar.gz

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev4}/Makefile

@@ -71,6 +71,19 @@ else
 	HTTP_CONFIG := $(LANGGRAPH_HTTP)
 endif
 
+# Dev/test default: opt in to loopback + http webhooks.
+# ``test_custom_route`` etc use relative URLs to dispatch to my_router.py;
+# ``test_join_*`` / ``test_webhook_payload_on_timeouts`` / ``test_cron_*``
+# and the shutdown suite use ``http://localhost:{port}/webhook`` to a
+# pytest httpserver fixture — all of these are blocked by the secure
+# ``disable_loopback`` default (GHSA-q3v5-r5ch-p57j), and
+# ``require_https`` defaults to true once any webhooks.url block is
+# present, so explicitly disable it for the http httpserver fixture.
+# Production deployers don't use these Makefiles. Override with
+# ``LANGGRAPH_WEBHOOKS=...`` on the command line to exercise the secure
+# default during local development.
+LANGGRAPH_WEBHOOKS ?= {"url": {"disable_loopback": false, "require_https": false}}
+
 LANGGRAPH_STORE ?= ""
 ifeq ($(LANGGRAPH_STORE),custom)
 	STORE_CONFIG := {"path": "./tests/graphs/custom_store.py:generate_store"}
@@ -93,10 +106,10 @@ REVISION ?= $(shell git rev-parse --short HEAD)
 LANGGRAPH_ENCRYPTION ?=
 
 test-license-oss:
-	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_STORE='$(STORE_CONFIG)' LANGGRAPH_CHECKPOINTER='$(CHECKPOINTER_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run pytest -v $(XDIST_ARGS) $(TEST)
+	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_STORE='$(STORE_CONFIG)' LANGGRAPH_CHECKPOINTER='$(CHECKPOINTER_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run pytest -v $(XDIST_ARGS) $(TEST)
 
 test-watch-oss:
-	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run --no-sync ptw . -- -x -vv --ff --capture=no $(TEST)
+	LANGGRAPH_RUNTIME_EDITION=inmem LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' LANGGRAPH_HTTP='$(HTTP_CONFIG)' LANGGRAPH_ENCRYPTION='$(LANGGRAPH_ENCRYPTION)' REDIS_URI=_FAKE DATABASE_URI=:memory: MIGRATIONS_PATH=__inmem__ uv run --no-sync ptw . -- -x -vv --ff --capture=no $(TEST)
 
 test: test-license-oss
 test-watch: test-watch-oss
@@ -159,6 +172,7 @@ LANGSMITH_TRACING ?= false
 
 start:
 	LANGGRAPH_DISABLE_FILE_PERSISTENCE=$(LANGGRAPH_DISABLE_FILE_PERSISTENCE) \
+	LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' \
 	LANGGRAPH_HTTP='$(HTTP_CONFIG)' \
 	LANGGRAPH_RUNTIME_EDITION=inmem \
 	LANGGRAPH_AES_KEY='$(LANGGRAPH_AES_KEY)' \
@@ -186,6 +200,7 @@ start:
 start-license-oss: start
 
 start-encrypt:
+	LANGGRAPH_WEBHOOKS='$(LANGGRAPH_WEBHOOKS)' \
 	LANGGRAPH_HTTP='$(HTTP_CONFIG)' \
 	LANGGRAPH_RUNTIME_EDITION=inmem \
 	LANGGRAPH_AES_KEY='$(LANGGRAPH_AES_KEY)' \

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: langgraph-api
-Version: 0.9.0.dev3
+Version: 0.9.0.dev4
 Author-email: Will Fu-Hinthorn <will@langchain.dev>, Josh Rogers <josh@langchain.dev>, Parker Rule <parker@langchain.dev>
 License: Elastic-2.0
 License-File: LICENSE

langgraph_api-0.9.0.dev4/langgraph_api/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.9.0.dev4"

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev4}/langgraph_api/config/schemas.py

@@ -386,7 +386,26 @@ class WebhookUrlPolicy(TypedDict, total=False):
     max_url_length: int
     """Maximum permitted URL length in characters; longer inputs are rejected early."""
     disable_loopback: bool
-    """Disallow relative URLs (internal loopback calls) and localhost hostnames when true."""
+    """Disallow loopback-flavored webhook targets when true. Defaults to true.
+
+    Covers all of:
+    - Relative URLs (e.g. ``/internal/hook``) that would dispatch via the
+      in-process ASGI loopback transport at ``root_path="/noauth"``. These
+      bypass authentication and were the auth-bypass primitive behind
+      GHSA-q3v5-r5ch-p57j.
+    - Absolute URLs whose hostname is ``localhost`` / ``localhost.localdomain``
+      / ``host.docker.internal``.
+    - Absolute URLs that DNS-resolve into the IPv4 loopback range
+      (``127.0.0.0/8``) or IPv6 loopback (``::1/128``) — including
+      DNS-rebinding-style attacks where an arbitrary hostname resolves to
+      a loopback IP.
+
+    Operators who intentionally route webhooks to in-process routes
+    (e.g. for local development with ``langgraph dev``, or single-host
+    docker-compose setups dispatching to ``host.docker.internal``) can
+    set this to ``false`` to restore the pre-GHSA behavior. Only do this
+    when you control all routes that loopback webhooks can reach.
+    """
     disable_private_ips: bool
     """Block RFC 1918 / CGN private IP ranges as webhook targets when true.
 
@@ -426,7 +445,12 @@ def _validate_url_policy(
     if "max_url_length" not in policy:
         policy["max_url_length"] = 2048
     if "disable_loopback" not in policy:
-        policy["disable_loopback"] = False
+        # Secure default — covers GHSA-q3v5-r5ch-p57j (relative-URL ASGI
+        # loopback auth bypass) and the broader SSRF surface that the same
+        # flag governs via SSRFPolicy.block_localhost. Mirrored at the
+        # webhook.py read site so deployments without any webhooks block
+        # also get the safe default.
+        policy["disable_loopback"] = True
     if "disable_private_ips" not in policy:
         policy["disable_private_ips"] = False
     return policy

{langgraph_api-0.9.0.dev3 → langgraph_api-0.9.0.dev4}/langgraph_api/webhook.py

@@ -79,7 +79,14 @@ def _get_webhook_config() -> _WebhookConfig:
     exact_allowed = frozenset(exact_hosts)
 
     disable_private_ips = bool(policy_cfg.get("disable_private_ips", False))
-    disable_loopback = bool(policy_cfg.get("disable_loopback", False))
+    # Loopback webhooks are denied by default (covers relative URLs that
+    # would dispatch through the in-process ASGI client at root_path=/noauth,
+    # plus localhost / 127.x / ::1 / host.docker.internal absolute URLs,
+    # plus any hostname that DNS-resolves into the loopback range). This is
+    # the fix for GHSA-q3v5-r5ch-p57j: relative-URL webhooks were the auth
+    # bypass primitive, and the localhost/loopback IP variants are the
+    # broader SSRF surface that the same flag governs via SSRFPolicy.
+    disable_loopback = bool(policy_cfg.get("disable_loopback", True))
 
     return _WebhookConfig(
         allowed_domains=allowed_domains,
@@ -111,11 +118,26 @@ async def validate_webhook_url_or_raise(url: str) -> None:
     if len(url) > wh.max_url_length:
         raise HTTPException(status_code=422, detail="Webhook URL too long")
 
-    # Relative loopback URL (internal route) — not subject to SSRF checks
+    # Relative loopback URL (internal route) — dispatched via an in-process
+    # ASGI client that mounts under root_path="/noauth", which the auth
+    # middleware treats as an auth-bypass marker. Denied by default so a
+    # user-supplied webhook URL cannot be turned into an unauthenticated
+    # call against the server's own routes (GHSA-q3v5-r5ch-p57j). Operators
+    # who intentionally route webhooks to in-process routes can opt back in
+    # by setting webhooks.url.disable_loopback to false.
     if url.startswith("/"):
         if wh.disable_loopback:
             raise HTTPException(
-                status_code=422, detail="Loopback webhooks are disabled"
+                status_code=422,
+                detail=(
+                    "Loopback webhooks (relative URLs and localhost) are "
+                    "disabled by default. They bypass authentication via the "
+                    "in-process ASGI transport and can be abused to invoke "
+                    "internal routes as an unauthenticated caller. Set "
+                    "webhooks.url.disable_loopback to false (in langgraph.json "
+                    "or via LANGGRAPH_WEBHOOKS) to opt back in — only do so "
+                    "when you control the mounted routes."
+                ),
             )
         return
 

langgraph_api-0.9.0.dev3/langgraph_api/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.9.0.dev3"