semantic-kernel 1.43.1__tar.gz → 1.44.0__tar.gz

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: semantic-kernel
-Version: 1.43.1
+Version: 1.44.0
 Summary: Semantic Kernel Python SDK
 Author-email: Microsoft <SK-Support@microsoft.com>
 Requires-Python: >=3.10
@@ -55,12 +55,12 @@ Requires-Dist: google-cloud-aiplatform>=1.114,<1.134 ; extra == "google"
 Requires-Dist: google-genai >= 1.51,< 1.75 ; extra == "google"
 Requires-Dist: transformers[torch] ~= 4.28 ; extra == "hugging-face"
 Requires-Dist: sentence-transformers >= 2.2,< 6.0 ; extra == "hugging-face"
-Requires-Dist: torch == 2.8.0 ; extra == "hugging-face"
+Requires-Dist: torch==2.12.0 ; extra == "hugging-face"
 Requires-Dist: mcp>=1.8 ; extra == "mcp"
 Requires-Dist: pymilvus >= 2.3,< 2.7 ; extra == "milvus"
 Requires-Dist: milvus >= 2.3,<2.3.8 ; extra == "milvus" and ( platform_system != 'Windows')
 Requires-Dist: mistralai >= 1.2,< 2.4.6 ; extra == "mistralai"
-Requires-Dist: pymongo >= 4.8.0, < 4.16 ; extra == "mongo"
+Requires-Dist: pymongo >= 4.8.0, < 4.17 ; extra == "mongo"
 Requires-Dist: motor >= 3.3.2,< 3.8.0 ; extra == "mongo"
 Requires-Dist: ipykernel >= 6.29,< 8.0 ; extra == "notebooks"
 Requires-Dist: ollama ~= 0.4 ; extra == "ollama"
@@ -79,7 +79,7 @@ Requires-Dist: types-redis ~= 4.6.0.20240425 ; extra == "redis"
 Requires-Dist: redisvl ~= 0.4 ; extra == "redis"
 Requires-Dist: pyodbc >= 5.2 ; extra == "sql"
 Requires-Dist: usearch ~= 2.16 ; extra == "usearch"
-Requires-Dist: pyarrow >= 12.0,< 22.0 ; extra == "usearch"
+Requires-Dist: pyarrow>=12.0,<24.0 ; extra == "usearch"
 Requires-Dist: weaviate-client>=4.17.0,<5.0 ; extra == "weaviate"
 Project-URL: homepage, https://learn.microsoft.com/en-us/semantic-kernel/overview/
 Project-URL: issues, https://github.com/microsoft/semantic-kernel/issues

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/pyproject.toml

@@ -93,7 +93,7 @@ google = [
 hugging_face = [
     "transformers[torch] ~= 4.28",
     "sentence-transformers >= 2.2,< 6.0",
-    "torch == 2.8.0"
+    "torch==2.12.0"
 ]
 mcp = [
     "mcp>=1.8",
@@ -106,7 +106,7 @@ mistralai = [
     "mistralai >= 1.2,< 2.4.6"
 ]
 mongo = [
-    "pymongo >= 4.8.0, < 4.16",
+    "pymongo >= 4.8.0, < 4.17",
     "motor >= 3.3.2,< 3.8.0"
 ]
 notebooks = [
@@ -150,7 +150,7 @@ sql = [
 ]
 usearch = [
     "usearch ~= 2.16",
-    "pyarrow >= 12.0,< 22.0"
+    "pyarrow>=12.0,<24.0"
 ]
 weaviate = [
     "weaviate-client>=4.17.0,<5.0",
@@ -164,7 +164,7 @@ dev = [
     "pytest ~= 8.2",
     "pytest-xdist[psutil] ~= 3.6",
     "pytest-cov >= 5.0",
-    "pytest-asyncio ~= 0.24",
+    "pytest-asyncio ~= 1.0",
     "pytest-timeout>=2.3.1",
     "snoop ~= 0.4",
     "mypy >= 1.10",

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/semantic_kernel/__init__.py

@@ -2,7 +2,7 @@
 
 from semantic_kernel.kernel import Kernel
 
-__version__ = "1.43.1"
+__version__ = "1.44.0"
 
 DEFAULT_RC_VERSION = f"{__version__}-rc9"
 

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/semantic_kernel/connectors/ai/open_ai/services/_open_ai_realtime.py

@@ -480,8 +480,29 @@ class OpenAIRealtimeBase(OpenAIHandler, RealtimeClientBase):
         )
 
         # Step 4: Invoke the function call
-        chat_history = ChatHistory()
+        # Fail closed: only invoke when a function choice behavior is available so the allowlist can be enforced.
+        # Without it, kernel.invoke_function_call would skip allowlist validation and execute any named function.
         function_behavior = self._current_settings.function_choice_behavior if self._current_settings else None
+        if function_behavior is None:
+            logger.warning(
+                "Skipping function call '%s-%s' because no function choice behavior is configured; "
+                "allowlist validation cannot be enforced.",
+                plugin_name,
+                function_name,
+            )
+            created_output = FunctionResultContent.from_function_call_content_and_result(
+                function_call_content=item,
+                result="Function call was not invoked because function choice behavior is not configured.",
+            )
+            result = RealtimeFunctionResultEvent(
+                service_type=SendEvents.CONVERSATION_ITEM_CREATE,
+                function_result=created_output,
+            )
+            await self.send(result)
+            await self.send(RealtimeEvent(service_type=SendEvents.RESPONSE_CREATE))
+            yield result
+            return
+        chat_history = ChatHistory()
         await self._kernel.invoke_function_call(item, chat_history, function_behavior=function_behavior)
         created_output: FunctionResultContent = chat_history.messages[-1].items[0]  # type: ignore
         # Step 5: Create the function result event
@@ -710,8 +731,7 @@ class OpenAIRealtimeWebRTCBase(OpenAIRealtimeBase):
         if audio_output_callback:
             self.audio_output_callback = audio_output_callback
         while True:
-            event = await self._receive_buffer.get()
-            yield event
+            yield await self._receive_buffer.get()
 
     async def _send(self, event: RealtimeClientEvent) -> None:
         if not self.data_channel:

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/semantic_kernel/connectors/mcp.py

@@ -246,6 +246,7 @@ class MCPPluginBase:
         kernel: Kernel | None = None,
         request_timeout: int | None = None,
         sampling_consent_callback: SamplingConsentCallback | None = None,
+        sampling_auto_approve: bool = False,
     ) -> None:
         """Initialize the MCP Plugin Base.
 
@@ -259,8 +260,11 @@ class MCPPluginBase:
             request_timeout: The default timeout used for all requests.
             sampling_consent_callback: Optional callback for approving MCP sampling requests.
                 Receives the plugin name and MCP sampling request params. Return
-                False to deny the request. When omitted, sampling requests are
-                auto-approved and a warning is logged.
+                False to deny the request. Takes precedence over sampling_auto_approve.
+            sampling_auto_approve: Whether to auto-approve MCP sampling requests when no
+                sampling_consent_callback is configured. Defaults to False, meaning sampling
+                requests are denied unless a consent callback is provided or this flag is set
+                to True. Set to True only when connecting to a trusted MCP server.
         """
         self.name = name
         self.description = description
@@ -271,6 +275,7 @@ class MCPPluginBase:
         self.kernel = kernel or None
         self.request_timeout = request_timeout
         self.sampling_consent_callback = sampling_consent_callback
+        self.sampling_auto_approve = sampling_auto_approve
         self._sampling_auto_approved_warning_logged = False
         self._mcp_reserved_attribute_names: set[str] | None = None
         self._current_task: asyncio.Task | None = None
@@ -383,13 +388,25 @@ class MCPPluginBase:
 
         If a sampling consent callback is configured, it is called before forwarding the request to the configured
         chat completion service. Returning False denies the request. If no callback is configured, requests are
-        auto-approved and a warning is logged.
+        denied unless sampling_auto_approve is set to True, in which case they are auto-approved and a warning is
+        logged.
         """
         if self.sampling_consent_callback is None:
+            if not self.sampling_auto_approve:
+                logger.warning(
+                    "MCP sampling request for plugin '%s' was denied because no sampling consent callback was "
+                    "configured. Provide a sampling_consent_callback or set sampling_auto_approve=True to allow "
+                    "sampling requests.",
+                    self.name,
+                )
+                return types.ErrorData(
+                    code=types.INTERNAL_ERROR,
+                    message="Sampling denied: no consent callback configured.",
+                )
             if not self._sampling_auto_approved_warning_logged:
                 logger.warning(
-                    "MCP sampling request for plugin '%s' was auto-approved because no sampling consent callback "
-                    "was configured.",
+                    "MCP sampling request for plugin '%s' was auto-approved because sampling_auto_approve is "
+                    "enabled and no sampling consent callback was configured.",
                     self.name,
                 )
                 self._sampling_auto_approved_warning_logged = True
@@ -620,6 +637,7 @@ class MCPStdioPlugin(MCPPluginBase):
         encoding: str | None = None,
         kernel: Kernel | None = None,
         sampling_consent_callback: SamplingConsentCallback | None = None,
+        sampling_auto_approve: bool = False,
         **kwargs: Any,
     ) -> None:
         """Initialize the MCP stdio plugin.
@@ -643,8 +661,10 @@ class MCPStdioPlugin(MCPPluginBase):
             kernel: The kernel instance with one or more Chat Completion clients.
             sampling_consent_callback: Optional callback for approving MCP sampling requests.
                 Receives the plugin name and MCP sampling request params. Return
-                False to deny the request. When omitted, sampling requests are
-                auto-approved and a warning is logged.
+                False to deny the request. Takes precedence over sampling_auto_approve.
+            sampling_auto_approve: Whether to auto-approve MCP sampling requests when no
+                sampling_consent_callback is configured. Defaults to False (requests are denied).
+                Set to True only when connecting to a trusted MCP server.
             kwargs: Any extra arguments to pass to the stdio client.
 
         """
@@ -657,6 +677,7 @@ class MCPStdioPlugin(MCPPluginBase):
             load_prompts=load_prompts,
             request_timeout=request_timeout,
             sampling_consent_callback=sampling_consent_callback,
+            sampling_auto_approve=sampling_auto_approve,
         )
         self.command = command
         self.args = args or []
@@ -696,6 +717,7 @@ class MCPSsePlugin(MCPPluginBase):
         sse_read_timeout: float | None = None,
         kernel: Kernel | None = None,
         sampling_consent_callback: SamplingConsentCallback | None = None,
+        sampling_auto_approve: bool = False,
         **kwargs: Any,
     ) -> None:
         """Initialize the MCP sse plugin.
@@ -720,8 +742,10 @@ class MCPSsePlugin(MCPPluginBase):
             kernel: The kernel instance with one or more Chat Completion clients.
             sampling_consent_callback: Optional callback for approving MCP sampling requests.
                 Receives the plugin name and MCP sampling request params. Return
-                False to deny the request. When omitted, sampling requests are
-                auto-approved and a warning is logged.
+                False to deny the request. Takes precedence over sampling_auto_approve.
+            sampling_auto_approve: Whether to auto-approve MCP sampling requests when no
+                sampling_consent_callback is configured. Defaults to False (requests are denied).
+                Set to True only when connecting to a trusted MCP server.
             kwargs: Any extra arguments to pass to the sse client.
 
         """
@@ -734,6 +758,7 @@ class MCPSsePlugin(MCPPluginBase):
             load_prompts=load_prompts,
             request_timeout=request_timeout,
             sampling_consent_callback=sampling_consent_callback,
+            sampling_auto_approve=sampling_auto_approve,
         )
         self.url = url
         self.headers = headers or {}
@@ -776,6 +801,7 @@ class MCPStreamableHttpPlugin(MCPPluginBase):
         terminate_on_close: bool | None = None,
         kernel: Kernel | None = None,
         sampling_consent_callback: SamplingConsentCallback | None = None,
+        sampling_auto_approve: bool = False,
         **kwargs: Any,
     ) -> None:
         """Initialize the MCP streamable http plugin.
@@ -801,8 +827,10 @@ class MCPStreamableHttpPlugin(MCPPluginBase):
             kernel: The kernel instance with one or more Chat Completion clients.
             sampling_consent_callback: Optional callback for approving MCP sampling requests.
                 Receives the plugin name and MCP sampling request params. Return
-                False to deny the request. When omitted, sampling requests are
-                auto-approved and a warning is logged.
+                False to deny the request. Takes precedence over sampling_auto_approve.
+            sampling_auto_approve: Whether to auto-approve MCP sampling requests when no
+                sampling_consent_callback is configured. Defaults to False (requests are denied).
+                Set to True only when connecting to a trusted MCP server.
             kwargs: Any extra arguments to pass to the sse client.
         """
         super().__init__(
@@ -814,6 +842,7 @@ class MCPStreamableHttpPlugin(MCPPluginBase):
             load_prompts=load_prompts,
             request_timeout=request_timeout,
             sampling_consent_callback=sampling_consent_callback,
+            sampling_auto_approve=sampling_auto_approve,
         )
         self.url = url
         self.headers = headers or {}
@@ -855,6 +884,7 @@ class MCPWebsocketPlugin(MCPPluginBase):
         description: str | None = None,
         kernel: Kernel | None = None,
         sampling_consent_callback: SamplingConsentCallback | None = None,
+        sampling_auto_approve: bool = False,
         **kwargs: Any,
     ) -> None:
         """Initialize the MCP websocket plugin.
@@ -876,8 +906,10 @@ class MCPWebsocketPlugin(MCPPluginBase):
             kernel: The kernel instance with one or more Chat Completion clients.
             sampling_consent_callback: Optional callback for approving MCP sampling requests.
                 Receives the plugin name and MCP sampling request params. Return
-                False to deny the request. When omitted, sampling requests are
-                auto-approved and a warning is logged.
+                False to deny the request. Takes precedence over sampling_auto_approve.
+            sampling_auto_approve: Whether to auto-approve MCP sampling requests when no
+                sampling_consent_callback is configured. Defaults to False (requests are denied).
+                Set to True only when connecting to a trusted MCP server.
             kwargs: Any extra arguments to pass to the websocket client.
 
         """
@@ -890,6 +922,7 @@ class MCPWebsocketPlugin(MCPPluginBase):
             load_prompts=load_prompts,
             request_timeout=request_timeout,
             sampling_consent_callback=sampling_consent_callback,
+            sampling_auto_approve=sampling_auto_approve,
         )
         self.url = url
         self._client_kwargs = kwargs
@@ -1023,6 +1056,7 @@ def create_mcp_server_from_kernel(
     functions_to_expose = [
         func for func in kernel.get_full_list_of_function_metadata() if func.name not in (excluded_functions or [])
     ]
+    exposed_names = frozenset(func.name for func in functions_to_expose)
 
     if len(functions_to_expose) > 0:
 
@@ -1058,8 +1092,15 @@ def create_mcp_server_from_kernel(
             *args: Any,
         ) -> Sequence[types.TextContent | types.ImageContent | types.AudioContent | types.EmbeddedResource]:
             """Call a tool in the kernel."""
-            await _log(level="debug", data=f"Calling tool with args: {args}")
             function_name, arguments = args[0], args[1]
+            if function_name not in exposed_names:
+                raise McpError(
+                    error=types.ErrorData(
+                        code=types.METHOD_NOT_FOUND,
+                        message=f"Unknown tool: {function_name}",
+                    )
+                )
+            await _log(level="debug", data=f"Calling tool: {function_name}")
             result = await _call_kernel_function(function_name, arguments)
             if result:
                 value = result.value
@@ -1165,7 +1206,6 @@ def create_mcp_server_from_kernel(
     async def _call_kernel_function(function_name: str, arguments: Any) -> FunctionResult | None:
         function = kernel.get_function(plugin_name=None, function_name=function_name)
         arguments["server"] = server
-        print("arguments", arguments)
         return await function.invoke(kernel=kernel, **arguments)
 
     return server

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/semantic_kernel/connectors/openapi_plugin/__init__.py

@@ -7,5 +7,11 @@ from semantic_kernel.connectors.openapi_plugin.openapi_parser import OpenApiPars
 from semantic_kernel.connectors.openapi_plugin.operation_selection_predicate_context import (
     OperationSelectionPredicateContext,
 )
+from semantic_kernel.connectors.openapi_plugin.server_url_validator import ServerUrlValidationOptions
 
-__all__ = ["OpenAPIFunctionExecutionParameters", "OpenApiParser", "OperationSelectionPredicateContext"]
+__all__ = [
+    "OpenAPIFunctionExecutionParameters",
+    "OpenApiParser",
+    "OperationSelectionPredicateContext",
+    "ServerUrlValidationOptions",
+]

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/semantic_kernel/connectors/openapi_plugin/models/rest_api_operation.py

@@ -221,12 +221,48 @@ class RestApiOperation:
 
     def build_operation_url(self, arguments, server_url_override=None, api_host_url=None):
         """Build the URL for the operation."""
-        server_url = self.get_server_url(server_url_override, api_host_url)
+        server_url = self.get_server_url(server_url_override, api_host_url, arguments)
         path = self.build_path(self.path, arguments)
         try:
-            return urljoin(server_url, path.lstrip("/"))
+            request_url = urljoin(server_url, path.lstrip("/"))
         except Exception as e:
             raise FunctionExecutionException(f"Error building the URL for the operation {self.id}: {e!s}") from e
+        self._ensure_request_target_matches_server(server_url, request_url)
+        return request_url
+
+    @staticmethod
+    def _ensure_request_target_matches_server(server_url: str, request_url: str) -> None:
+        """Verify URL construction did not move the request off the configured server.
+
+        A selected operation path must resolve to a request on the same scheme, host, and port and
+        within the server's base path. Otherwise an absolute or authority-changing operation path
+        (for example "https://another-host/admin") could redirect a credential-bearing request to an
+        unintended target even though it carries no dot-segment. This complements
+        `_validate_path_segments` so operation selection, path validation, and request construction
+        share one canonical target.
+        """
+        server = urlparse(server_url)
+        request = urlparse(request_url)
+
+        if (request.scheme, request.username, request.password, request.hostname, request.port) != (
+            server.scheme,
+            server.username,
+            server.password,
+            server.hostname,
+            server.port,
+        ):
+            raise FunctionExecutionException(
+                f"The operation path resolves to '{request.scheme}://{request.netloc}', which does not match "
+                f"the configured server '{server.scheme}://{server.netloc}'."
+            )
+
+        # get_server_url guarantees a trailing slash, so the server base path always ends with "/".
+        base_path = server.path
+        if request.path != base_path.rstrip("/") and not request.path.startswith(base_path):
+            raise FunctionExecutionException(
+                f"The operation path resolves to '{request.path}', which is outside the configured server "
+                f"base path '{base_path}'."
+            )
 
     def get_server_url(self, server_url_override=None, api_host_url=None, arguments=None):
         """Get the server URL for the operation."""
@@ -253,11 +289,11 @@ class RestApiOperation:
                 argument_name = variable_def.get("argument_name", variable_name)
                 if argument_name in arguments:
                     value = arguments[argument_name]
-                    server_url_string = server_url_string.replace(f"{{{variable_name}}}", value)
+                    server_url_string = server_url_string.replace(f"{{{variable_name}}}", str(value))
                 elif "default" in variable_def and variable_def["default"] is not None:
                     # Use the default value if no argument is provided
                     value = variable_def["default"]
-                    server_url_string = server_url_string.replace(f"{{{variable_name}}}", value)
+                    server_url_string = server_url_string.replace(f"{{{variable_name}}}", str(value))
                 else:
                     # Raise an exception if no value is available
                     raise FunctionExecutionException(
@@ -299,6 +335,20 @@ class RestApiOperation:
         The operation is selected using the raw path but the request URL is built from a canonicalized
         path, so encoded dot-segments such as "%2e%2e" must be rejected before the URL is constructed.
         """
+        if RestApiOperation._contains_dot_segment(path):
+            raise FunctionExecutionException(
+                f"Path '{path}' contains a dot-segment, which could lead to path traversal."
+            )
+
+    @staticmethod
+    def _contains_dot_segment(path: str) -> bool:
+        """Return True if the path contains a dot-segment (. or ..), including percent-encoded forms.
+
+        Used both to reject such paths when building a request URL and to exclude them during operation
+        selection so an encoded dot-segment cannot bypass an include/exclude operation-selection filter.
+        """
+        if not path:
+            return False
         for segment in path.split("/"):
             decoded = segment
             for _ in range(5):
@@ -310,9 +360,24 @@ class RestApiOperation:
             # both "/" and "\" and reject any resulting dot-segment.
             for part in decoded.replace("\\", "/").split("/"):
                 if part in (".", ".."):
-                    raise FunctionExecutionException(
-                        f"Path '{path}' contains a dot-segment, which could lead to path traversal."
-                    )
+                    return True
+        return False
+
+    @staticmethod
+    def _is_non_relative_path(path: str) -> bool:
+        """Return True if the path is non-relative (absolute or authority-changing).
+
+        A conformant OpenAPI operation path is relative to the server URL. An absolute URI, a
+        protocol-relative reference ("//host"), or a backslash-authority reference changes the request
+        target once combined with the server URL, so such a path is excluded during operation selection
+        to keep selection and request construction on one canonical target.
+        """
+        if not path:
+            return False
+        if path.startswith(("//", "\\\\", "/\\", "\\/")):
+            return True
+        parsed = urlparse(path)
+        return bool(parsed.scheme or parsed.netloc)
 
     def build_query_string(self, arguments: dict[str, Any]) -> str:
         """Build the query string for the operation."""

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/semantic_kernel/connectors/openapi_plugin/openapi_function_execution_parameters.py

@@ -16,7 +16,13 @@ AuthCallbackType = Callable[..., Awaitable[Any]]
 
 
 class OpenAPIFunctionExecutionParameters(KernelBaseModel):
-    """OpenAPI function execution parameters."""
+    """OpenAPI function execution parameters.
+
+    OpenAPI operation request URLs are validated by default to reduce SSRF risk. Requests must use HTTPS
+    and must not resolve to private, loopback, link-local, or otherwise non-public IP addresses unless the
+    target is explicitly trusted through `server_url_validation_allowed_base_urls` or
+    `allow_private_network_access`.
+    """
 
     http_client: httpx.AsyncClient | None = None
     auth_callback: AuthCallbackType | None = None
@@ -47,9 +53,24 @@ class OpenAPIFunctionExecutionParameters(KernelBaseModel):
             "and need external HTTP $ref resolution."
         ),
     )
+    server_url_validation_allowed_base_urls: list[str] = Field(
+        default_factory=list,
+        description=(
+            "Base URLs that are explicitly allowed for OpenAPI operation requests. Matching URLs bypass "
+            "the default HTTPS-only and private-network validation gates. Set only for trusted endpoints."
+        ),
+    )
+    allow_private_network_access: bool = Field(
+        False,
+        description=(
+            "Whether OpenAPI operation requests may target private, loopback, link-local, or otherwise "
+            "non-public IP addresses. Disabled by default to prevent SSRF."
+        ),
+    )
 
     def model_post_init(self, __context: Any) -> None:
         """Post initialization method for the model."""
+        from semantic_kernel.connectors.openapi_plugin.server_url_validator import ServerUrlValidationOptions
         from semantic_kernel.utils.telemetry.user_agent import HTTP_USER_AGENT
 
         if self.server_url_override:
@@ -57,5 +78,7 @@ class OpenAPIFunctionExecutionParameters(KernelBaseModel):
             if not parsed_url.scheme or not parsed_url.netloc:
                 raise ValueError(f"Invalid server_url_override: {self.server_url_override}")
 
+        ServerUrlValidationOptions(allowed_base_urls=self.server_url_validation_allowed_base_urls)
+
         if not self.user_agent:
             self.user_agent = HTTP_USER_AGENT

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/semantic_kernel/connectors/openapi_plugin/openapi_manager.py

@@ -11,6 +11,7 @@ from semantic_kernel.connectors.openapi_plugin.models.rest_api_security_requirem
 from semantic_kernel.connectors.openapi_plugin.models.rest_api_uri import Uri
 from semantic_kernel.connectors.openapi_plugin.openapi_parser import OpenApiParser
 from semantic_kernel.connectors.openapi_plugin.openapi_runner import OpenApiRunner
+from semantic_kernel.connectors.openapi_plugin.server_url_validator import ServerUrlValidationOptions
 from semantic_kernel.exceptions.function_exceptions import FunctionExecutionException
 from semantic_kernel.functions.kernel_arguments import KernelArguments
 from semantic_kernel.functions.kernel_function_decorator import kernel_function
@@ -79,6 +80,12 @@ def create_functions_from_openapi(
         http_client=execution_settings.http_client if execution_settings else None,
         enable_dynamic_payload=execution_settings.enable_dynamic_payload if execution_settings else True,
         enable_payload_namespacing=execution_settings.enable_payload_namespacing if execution_settings else False,
+        server_url_validation_options=ServerUrlValidationOptions(
+            allowed_base_urls=execution_settings.server_url_validation_allowed_base_urls,
+            allow_private_network_access=execution_settings.allow_private_network_access,
+        )
+        if execution_settings
+        else None,
     )
 
     functions = []

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/semantic_kernel/connectors/openapi_plugin/openapi_parser.py

@@ -265,6 +265,18 @@ class OpenApiParser:
                 summary = details.get("summary", None)
                 description = details.get("description", None)
 
+                # Exclude operations whose path would resolve to a different effective request target
+                # than the one offered to the selection predicate: a dot-segment (encoded or literal)
+                # or a non-relative (absolute / authority-changing) path. Excluding them here keeps
+                # operation selection and request construction on one canonical target so such a path
+                # cannot bypass an include/exclude operation-selection filter.
+                if RestApiOperation._contains_dot_segment(path) or RestApiOperation._is_non_relative_path(path):
+                    logger.warning(
+                        f"Skipping operation {operationId} at path '{path}' because it does not resolve to a "
+                        f"relative path on the configured server."
+                    )
+                    continue
+
                 context = OperationSelectionPredicateContext(operationId, path, method, description)
                 if (
                     execution_settings

{semantic_kernel-1.43.1 → semantic_kernel-1.44.0}/semantic_kernel/connectors/openapi_plugin/openapi_runner.py

@@ -17,6 +17,10 @@ from semantic_kernel.connectors.openapi_plugin.models.rest_api_expected_response
 from semantic_kernel.connectors.openapi_plugin.models.rest_api_operation import RestApiOperation
 from semantic_kernel.connectors.openapi_plugin.models.rest_api_payload import RestApiPayload
 from semantic_kernel.connectors.openapi_plugin.models.rest_api_run_options import RestApiRunOptions
+from semantic_kernel.connectors.openapi_plugin.server_url_validator import (
+    ServerUrlValidationOptions,
+    validate_server_url,
+)
 from semantic_kernel.exceptions.function_exceptions import FunctionExecutionException
 from semantic_kernel.functions.kernel_arguments import KernelArguments
 from semantic_kernel.utils.feature_stage_decorator import experimental
@@ -39,6 +43,7 @@ class OpenApiRunner:
         http_client: httpx.AsyncClient | None = None,
         enable_dynamic_payload: bool = True,
         enable_payload_namespacing: bool = False,
+        server_url_validation_options: ServerUrlValidationOptions | None = None,
     ):
         """Initialize the OpenApiRunner."""
         self.spec = Spec.from_dict(parsed_openapi_document)  # type: ignore
@@ -46,6 +51,7 @@ class OpenApiRunner:
         self.http_client = http_client
         self.enable_dynamic_payload = enable_dynamic_payload
         self.enable_payload_namespacing = enable_payload_namespacing
+        self.server_url_validation_options = server_url_validation_options or ServerUrlValidationOptions()
 
     def build_full_url(self, base_url, query_string):
         """Build the full URL."""
@@ -137,6 +143,7 @@ class OpenApiRunner:
             server_url_override=options.server_url_override if options else None,
             api_host_url=options.api_host_url if options else None,
         )
+        await validate_server_url(url, self.server_url_validation_options)
         headers = operation.build_headers(arguments=arguments)
         payload, _ = self.build_operation_payload(operation=operation, arguments=arguments)