soup-cli 0.75.1__tar.gz → 0.75.2__tar.gz

{soup_cli-0.75.1 → soup_cli-0.75.2}/CHANGELOG.md

@@ -12,6 +12,28 @@ reproducing 70+ versions of notes.
 
 ## [Unreleased]
 
+## [0.75.2] - 2026-10-01
+
+### Changed
+
+- Outbound endpoint checks now refuse a private, link-local or reserved IP literal over `https` as well as `http`. This covers `soup data generate --api-base`, the vLLM provider and the commands that use it, judge URLs in `soup eval judge`, eval-gate suites, `soup ship --judge-model` / `eval.ship.judge_model` and `training.online_dpo_judge`, and the Web UI chat proxy. Loopback still works; address a LAN server by its hostname. `training.online_dpo_judge` is now checked when soup.yaml loads, not only when the trainer starts.
+
+- `soup data generate --api-base` and the Web UI chat proxy no longer treat `http://0.0.0.0` as local; use `localhost` or `127.0.0.1`.
+
+- `100.64.0.0/10` and `fec0::/10` literals are now treated as non-public by every check that already refused private addresses (webhooks, the OTLP endpoint, telemetry, hub endpoints over HTTP, and `soup ingest --pull`, where `--allow-private-host` admits them).
+
+- Every check that refuses private addresses now also recognizes an IP literal written with non-ASCII digits or label separators, which an HTTP client folds to ASCII before it connects.
+
+### Fixed
+
+- `soup ship` checks `--judge-model` before it builds the base and tuned models; it used to load both and only then stop with a usage error.
+
+- The Web UI chat proxy answers 400, not 500, for an endpoint URL that does not parse.
+
+### Security
+
+- Hardening of outbound endpoint validation. A security advisory with details and upgrade guidance will be published alongside this release.
+
 ## [0.75.1] - 2026-09-21
 
 ### Fixed

{soup_cli-0.75.1 → soup_cli-0.75.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: soup-cli
-Version: 0.75.1
+Version: 0.75.2
 Summary: Fine-tune and post-train LLMs in one command. No SSH, no config hell.
 Project-URL: Homepage, https://github.com/MakazhanAlpamys/Soup
 Project-URL: Repository, https://github.com/MakazhanAlpamys/Soup
@@ -241,27 +241,20 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.75.1 — hardening, and cloud runs that keep what they produced.** A maintenance
-release on top of v0.75.0: no new training features, and a few defaults that change when
-you upgrade.
-
-- **Hardening across the CLI, the inference server, the Web UI, MCP execution, config
-  parsing and `.can` handling.** Details in an advisory published with this release.
-- **`soup runs clean` gained `--no-keep-weights`**, which deletes whole non-best
-  checkpoints rather than only their optimizer and scheduler states. `--keep-weights`
-  stays the default and now means the same thing on every supported Click version — on
-  Click 8.1 it used to delete whole checkpoints anyway.
-- **Cloud runs keep their outputs.** `soup train --cloud modal` writes run outputs to the
-  `soup-outputs` Modal volume and downloads them into your local output directory when the
-  run ends, including after a failed run; checkpoints used to disappear with the container.
-- **Ctrl+C on `soup train --cloud lambda --cloud-submit` waits for the controller** to
-  terminate the Lambda instance. The controller was previously killed a quarter of a
-  second later, which could leave a paid instance running (Linux/macOS).
-- **Upgrading changes a few defaults.** `soup push --hub modelscope` and `--hub modelers`
-  read `MODELSCOPE_API_TOKEN` and `MODELERS_TOKEN` rather than `HF_TOKEN`, so one hub's
-  token is never offered to another; and an `https` judge URL whose host is not
-  `api.openai.com` is treated as an OpenAI-compatible server and called without
-  `OPENAI_API_KEY`.
+**v0.75.2 — outbound endpoint checks refuse private addresses.** A security patch on top
+of v0.75.1 with one hardening change; everything merged since v0.75.0 ships in the next
+minor release.
+
+- **Endpoint URLs can no longer name a private address directly.** The
+  `soup data generate --api-base` URL, the vLLM provider, judge URLs (`soup eval judge`,
+  eval-gate suites, `soup ship --judge-model`, `training.online_dpo_judge`) and the Web UI
+  chat proxy refuse a private, link-local or reserved IP literal over `https` as well as
+  `http`. Loopback still works; address a server on your network by its hostname. Details
+  in an advisory published with this release.
+- **`http://0.0.0.0` is no longer treated as local** by `soup data generate --api-base` and
+  the Web UI chat proxy; use `localhost` or `127.0.0.1`.
+- **`100.64.0.0/10` and `fec0::/10` count as non-public** wherever private addresses were
+  already refused, including webhooks, the OTLP endpoint and `soup ingest --pull`.
 
 > Python **3.10–3.12** only. On 3.13+, pip used to resolve untested PyTorch wheels that
 > crash in the native extension before Soup runs at all.

{soup_cli-0.75.1 → soup_cli-0.75.2}/README.md

@@ -87,27 +87,20 @@ infrastructure instead of improving models. Soup fixes that.
 
 ## What's New
 
-**v0.75.1 — hardening, and cloud runs that keep what they produced.** A maintenance
-release on top of v0.75.0: no new training features, and a few defaults that change when
-you upgrade.
-
-- **Hardening across the CLI, the inference server, the Web UI, MCP execution, config
-  parsing and `.can` handling.** Details in an advisory published with this release.
-- **`soup runs clean` gained `--no-keep-weights`**, which deletes whole non-best
-  checkpoints rather than only their optimizer and scheduler states. `--keep-weights`
-  stays the default and now means the same thing on every supported Click version — on
-  Click 8.1 it used to delete whole checkpoints anyway.
-- **Cloud runs keep their outputs.** `soup train --cloud modal` writes run outputs to the
-  `soup-outputs` Modal volume and downloads them into your local output directory when the
-  run ends, including after a failed run; checkpoints used to disappear with the container.
-- **Ctrl+C on `soup train --cloud lambda --cloud-submit` waits for the controller** to
-  terminate the Lambda instance. The controller was previously killed a quarter of a
-  second later, which could leave a paid instance running (Linux/macOS).
-- **Upgrading changes a few defaults.** `soup push --hub modelscope` and `--hub modelers`
-  read `MODELSCOPE_API_TOKEN` and `MODELERS_TOKEN` rather than `HF_TOKEN`, so one hub's
-  token is never offered to another; and an `https` judge URL whose host is not
-  `api.openai.com` is treated as an OpenAI-compatible server and called without
-  `OPENAI_API_KEY`.
+**v0.75.2 — outbound endpoint checks refuse private addresses.** A security patch on top
+of v0.75.1 with one hardening change; everything merged since v0.75.0 ships in the next
+minor release.
+
+- **Endpoint URLs can no longer name a private address directly.** The
+  `soup data generate --api-base` URL, the vLLM provider, judge URLs (`soup eval judge`,
+  eval-gate suites, `soup ship --judge-model`, `training.online_dpo_judge`) and the Web UI
+  chat proxy refuse a private, link-local or reserved IP literal over `https` as well as
+  `http`. Loopback still works; address a server on your network by its hostname. Details
+  in an advisory published with this release.
+- **`http://0.0.0.0` is no longer treated as local** by `soup data generate --api-base` and
+  the Web UI chat proxy; use `localhost` or `127.0.0.1`.
+- **`100.64.0.0/10` and `fec0::/10` count as non-public** wherever private addresses were
+  already refused, including webhooks, the OTLP endpoint and `soup ingest --pull`.
 
 > Python **3.10–3.12** only. On 3.13+, pip used to resolve untested PyTorch wheels that
 > crash in the native extension before Soup runs at all.

{soup_cli-0.75.1 → soup_cli-0.75.2}/README.tr.md

@@ -1,4 +1,4 @@
-<!-- synced-from: README.md sha256:b524929506f026bba7a1f4522d3273328123c696a31b72dd1c7c4bee993a8fd4 -->
+<!-- synced-from: README.md sha256:aca2a4e15b1d8c4055ac1b650f9fd514bdfdc024e7d9dd86211a0796263d1d4b -->
 <p align="center">🌍 <a href="README.md">English</a> | <strong>Türkçe</strong></p>
 
 <p align="center">
@@ -88,30 +88,22 @@ yerine altyapıyla boğuşarak geçiriyor. Soup bunu çözer.
 
 ## Yenilikler
 
-**v0.75.1 — sıkılaştırma ve ürettiğini koruyan bulut çalıştırmaları.** v0.75.0'ın üzerine
-bir bakım sürümü: yeni eğitim özelliği yok, ama yükseltirken değişen birkaç varsayılan var.
-
-- **CLI, çıkarım sunucusu, Web arayüzü, MCP yürütmesi, yapılandırma ayrıştırması ve `.can`
-  işlemesi genelinde sıkılaştırma.** Ayrıntılar bu sürümle birlikte yayımlanan bir danışma
-  belgesinde.
-- **`soup runs clean` artık `--no-keep-weights` seçeneğini kabul ediyor**; bu seçenek, en
-  iyi olmayan kontrol noktalarını yalnızca optimizer ve zamanlayıcı durumlarıyla değil
-  bütünüyle siliyor. `--keep-weights` varsayılan olarak kalıyor ve artık desteklenen her
-  Click sürümünde aynı anlama geliyor — Click 8.1'de eskiden kontrol noktalarının tamamını
-  yine de siliyordu.
-- **Bulut çalıştırmaları çıktılarını koruyor.** `soup train --cloud modal`, çalıştırma
-  çıktılarını `soup-outputs` Modal birimine yazıyor ve çalıştırma bittiğinde — başarısız
-  bir çalıştırmadan sonra da — yerel çıktı dizininize indiriyor; kontrol noktaları eskiden
-  kapsayıcıyla birlikte kayboluyordu.
-- **`soup train --cloud lambda --cloud-submit` sırasında Ctrl+C artık denetleyicinin**
-  Lambda örneğini sonlandırmasını bekliyor. Denetleyici eskiden çeyrek saniye sonra
-  öldürülüyordu, bu da ücretli bir örneğin çalışmaya devam etmesine yol açabiliyordu
-  (Linux/macOS).
-- **Yükseltmek birkaç varsayılanı değiştiriyor.** `soup push --hub modelscope` ve
-  `--hub modelers`, `HF_TOKEN` yerine `MODELSCOPE_API_TOKEN` ve `MODELERS_TOKEN` okuyor;
-  böylece bir hub'ın belirteci hiçbir zaman başka bir hub'a sunulmuyor. Ayrıca ana
-  makinesi `api.openai.com` olmayan bir `https` yargıç URL'si, OpenAI uyumlu bir sunucu
-  olarak kabul edilip `OPENAI_API_KEY` olmadan çağrılıyor.
+**v0.75.2 — giden uç nokta denetimleri özel adresleri reddediyor.** v0.75.1'in üzerine
+tek bir sıkılaştırma değişikliği içeren bir güvenlik yaması; v0.75.0'dan bu yana
+birleştirilen her şey bir sonraki ara sürümde geliyor.
+
+- **Uç nokta URL'leri artık özel bir adresi doğrudan gösteremiyor.**
+  `soup data generate --api-base` URL'si, vLLM sağlayıcısı, yargıç URL'leri (`soup eval judge`,
+  eval-gate paketleri, `soup ship --judge-model`, `training.online_dpo_judge`) ve Web
+  arayüzünün sohbet vekili; özel, bağlantı-yerel (link-local) veya ayrılmış bir IP
+  değişmezini yalnızca `http` üzerinden değil `https` üzerinden de reddediyor. Geri döngü
+  (loopback) çalışmaya devam ediyor; ağınızdaki bir sunucuya ana makine adıyla erişin.
+  Ayrıntılar bu sürümle birlikte yayımlanan bir danışma belgesinde.
+- **`http://0.0.0.0` artık yerel sayılmıyor**: `soup data generate --api-base` ve Web
+  arayüzünün sohbet vekili için `localhost` veya `127.0.0.1` kullanın.
+- **`100.64.0.0/10` ve `fec0::/10` herkese açık olmayan adres sayılıyor**: web kancaları,
+  OTLP uç noktası ve `soup ingest --pull` dahil, özel adreslerin zaten reddedildiği her
+  yerde.
 
 > Yalnızca Python **3.10–3.12**. 3.13+ sürümlerinde pip, Soup daha hiç çalışmadan yerel
 > eklentide çöken, test edilmemiş PyTorch tekerleklerini çözümlüyordu.

{soup_cli-0.75.1 → soup_cli-0.75.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "soup-cli"
-version = "0.75.1"
+version = "0.75.2"
 description = "Fine-tune and post-train LLMs in one command. No SSH, no config hell."
 readme = "README.md"
 license = "Apache-2.0"

{soup_cli-0.75.1 → soup_cli-0.75.2}/src/soup_cli/__init__.py

@@ -1,3 +1,3 @@
 """Soup CLI — Fine-tune and post-train LLMs in one command."""
 
-__version__ = "0.75.1"
+__version__ = "0.75.2"

{soup_cli-0.75.1 → soup_cli-0.75.2}/src/soup_cli/commands/generate.py

@@ -710,17 +710,21 @@ def _generate_openai(
 
     base_url = api_base or "https://api.openai.com/v1"
 
-    # Validate api_base to prevent SSRF (block non-HTTPS remote URLs)
+    # Validate api_base to prevent SSRF (block non-HTTPS remote URLs and
+    # private / link-local / reserved IP literals; 0.0.0.0 is not loopback)
     if api_base:
         from urllib.parse import urlparse
 
+        from soup_cli.utils.net_guard import LOOPBACK_HOSTS, refuse_private_ip_literal
+
         parsed = urlparse(api_base)
-        is_local = parsed.hostname in ("localhost", "127.0.0.1", "::1", "0.0.0.0")
+        is_local = parsed.hostname in LOOPBACK_HOSTS
         if not is_local and parsed.scheme != "https":
             raise ValueError(
                 f"api_base must use HTTPS for remote APIs (got {parsed.scheme}://). "
                 "HTTP is only allowed for localhost."
             )
+        refuse_private_ip_literal(parsed.hostname, label="api_base")
 
     if generation_prompt is None:
         generation_prompt = _build_generation_prompt(prompt, count, fmt, seed_examples)
@@ -849,21 +853,25 @@ def _generate_server(
 
     base_url = api_base or "http://localhost:8000/v1"
 
-    # Validate api_base to prevent SSRF — only allow http/https, block remote non-HTTPS
+    # Validate api_base to prevent SSRF — only allow http/https, block remote
+    # non-HTTPS and private / link-local / reserved IP literals
     if api_base:
         from urllib.parse import urlparse
 
+        from soup_cli.utils.net_guard import LOOPBACK_HOSTS, refuse_private_ip_literal
+
         parsed = urlparse(api_base)
         if parsed.scheme not in ("http", "https"):
             raise ValueError(
                 f"api_base must use HTTP or HTTPS scheme (got {parsed.scheme}://)"
             )
-        is_local = parsed.hostname in ("localhost", "127.0.0.1", "::1", "0.0.0.0")
+        is_local = parsed.hostname in LOOPBACK_HOSTS
         if not is_local and parsed.scheme != "https":
             raise ValueError(
                 f"api_base must use HTTPS for remote APIs (got {parsed.scheme}://). "
                 "HTTP is only allowed for localhost."
             )
+        refuse_private_ip_literal(parsed.hostname, label="api_base")
 
     # Strip trailing /v1 if present (we add it to the endpoint path)
     base_url = base_url.rstrip("/")

{soup_cli-0.75.1 → soup_cli-0.75.2}/src/soup_cli/commands/ship.py

@@ -167,12 +167,22 @@ def _validate_judge_model_url(url: str) -> None:
     """SSRF guard for --judge-model: urlparse hostname check (not startswith).
 
     Blocks the ``http://localhost.attacker.com`` prefix-bypass that a bare
-    ``startswith("http://localhost")`` check would allow through.
+    ``startswith("http://localhost")`` check would allow through, and refuses a
+    private / link-local / reserved IP literal as a usage error before any
+    measurement runs.
     """
     from urllib.parse import urlparse
 
+    from soup_cli.utils.net_guard import refuse_private_ip_literal
+
     parsed = urlparse(url)
-    if parsed.scheme in ("ollama", "https"):
+    if parsed.scheme == "ollama":
+        return
+    if parsed.scheme == "https":
+        try:
+            refuse_private_ip_literal(parsed.hostname, label="--judge-model")
+        except ValueError as exc:
+            _fail(str(exc), _EXIT_USAGE)
         return
     if parsed.scheme == "http" and parsed.hostname in ("localhost", "127.0.0.1"):
         return
@@ -1004,21 +1014,22 @@ def _verdict_live(
     # would be an unbounded number of full model passes.
     noise_floor_runs = _validate_noise_floor_flag(noise_floor_runs)
 
+    # Judge modes need a judge model. Validate it BEFORE the base and tuned
+    # models load and before the noise floor is measured (it scores the leg-1
+    # task axis through the judge as well, #403) — a missing or refused judge
+    # URL is a usage error, not a runtime one discovered after a model load.
+    if task_mode == "judge_score":
+        if not judge_model:
+            _fail("--task-mode judge_score needs --judge-model <url>", _EXIT_USAGE)
+        _validate_judge_model_url(judge_model)
+    elif task_mode == "pairwise":
+        if not judge_model:
+            _fail("--task-mode pairwise needs --judge-model <url>", _EXIT_USAGE)
+        _validate_judge_model_url(judge_model)
+
     tuned_id = tuned if tuned else base
     try:
         base_gen, tuned_gen = _resolve_generators(base, tuned, adapter, device, quantization)
-        # Judge modes need a judge model. Validate it BEFORE measuring the
-        # noise floor, which now scores the leg-1 task axis through the judge as
-        # well (#403) — a missing / malformed judge is a usage error (exit 2),
-        # not a runtime one discovered mid-measurement.
-        if task_mode == "judge_score":
-            if not judge_model:
-                _fail("--task-mode judge_score needs --judge-model <url>", _EXIT_USAGE)
-            _validate_judge_model_url(judge_model)
-        elif task_mode == "pairwise":
-            if not judge_model:
-                _fail("--task-mode pairwise needs --judge-model <url>", _EXIT_USAGE)
-            _validate_judge_model_url(judge_model)
 
         measured_floor: Optional[NoiseFloor] = None
         if noise_floor_runs is not None:

{soup_cli-0.75.1 → soup_cli-0.75.2}/src/soup_cli/config/schema.py

@@ -1449,7 +1449,12 @@ class TrainingConfig(BaseModel):
     @field_validator("online_dpo_judge", mode="before")
     @classmethod
     def _validate_online_dpo_judge_field(cls, value: Any) -> Optional[str]:
-        """v0.71.31 — shape-only validation (SSRF enforced at trainer setup)."""
+        """v0.71.31 — shape validation; the full SSRF policy runs at trainer setup.
+
+        A private / link-local / reserved IP literal in an http(s) judge URL is
+        refused here as well, so a shared soup.yaml naming one fails at load
+        instead of after the model download.
+        """
         if value is None:
             return None
         if isinstance(value, bool) or not isinstance(value, str):
@@ -1462,6 +1467,16 @@ class TrainingConfig(BaseModel):
             raise ValueError("online_dpo_judge must not contain null bytes")
         if len(value) > 512:
             raise ValueError("online_dpo_judge must be <= 512 chars")
+        from urllib.parse import urlparse
+
+        from soup_cli.utils.net_guard import refuse_private_ip_literal
+
+        try:
+            parsed = urlparse(value)
+        except ValueError as exc:
+            raise ValueError("online_dpo_judge is not a valid URL") from exc
+        if parsed.scheme in ("http", "https"):
+            refuse_private_ip_literal(parsed.hostname, label="online_dpo_judge")
         return value
 
     # v0.71.32 — ASR (Whisper) fine-tuning knobs.

{soup_cli-0.75.1 → soup_cli-0.75.2}/src/soup_cli/data/providers/vllm.py

@@ -18,9 +18,12 @@ def validate_vllm_url(base_url: str) -> None:
     Reuses the same validation as the server provider:
     - Scheme must be http or https
     - HTTP is only allowed for localhost
+    - A private / link-local / reserved IP literal is refused on any scheme
 
     Raises ValueError if validation fails.
     """
+    from soup_cli.utils.net_guard import refuse_private_ip_literal
+
     parsed = urlparse(base_url)
     if parsed.scheme not in ("http", "https"):
         raise ValueError(
@@ -36,6 +39,7 @@ def validate_vllm_url(base_url: str) -> None:
             f"vLLM URL must use HTTPS for remote servers (got {parsed.scheme}://). "
             "HTTP is only allowed for localhost."
         )
+    refuse_private_ip_literal(parsed.hostname, label="vLLM URL")
 
 
 def generate_vllm(

{soup_cli-0.75.1 → soup_cli-0.75.2}/src/soup_cli/eval/gate.py

@@ -94,7 +94,15 @@ class GateTask(BaseModel):
         # Allowlist of schemes — SSRF hardening consistent with the project.
         parsed = urlparse(value)
 
-        if parsed.scheme in ("ollama","https"):
+        if parsed.scheme == "ollama":
+            return value
+
+        if parsed.scheme == "https":
+            # A private IP literal is refused when the suite is parsed, so a
+            # suite file cannot name one any more than --judge-model can.
+            from soup_cli.utils.net_guard import refuse_private_ip_literal
+
+            refuse_private_ip_literal(parsed.hostname, label="judge_model URL")
             return value
 
         if (parsed.scheme == "http" and parsed.hostname in {"localhost", "127.0.0.1"}):

{soup_cli-0.75.1 → soup_cli-0.75.2}/src/soup_cli/eval/judge.py

@@ -127,10 +127,17 @@ def load_rubric(path: Path) -> dict:
 
 
 def validate_judge_api_base(api_base: Optional[str]) -> None:
-    """SSRF protection for judge API base URL."""
+    """SSRF protection for judge API base URL.
+
+    ``JudgeEvaluator`` calls this when it is constructed, so every judge it
+    builds is checked, whether the URL came from ``--api-base`` or from a
+    config file.
+    """
     if api_base is None:
         return
 
+    from soup_cli.utils.net_guard import refuse_private_ip_literal
+
     parsed = urlparse(api_base)
     if parsed.scheme not in ("http", "https"):
         raise ValueError(
@@ -146,6 +153,8 @@ def validate_judge_api_base(api_base: Optional[str]) -> None:
                 "HTTP is only allowed for localhost. "
                 "Use HTTPS for remote URLs."
             )
+    # ...and no private / link-local / reserved IP literal on either scheme.
+    refuse_private_ip_literal(parsed.hostname, label="judge URL")
 
 
 def _build_judge_prompt(

{soup_cli-0.75.1 → soup_cli-0.75.2}/src/soup_cli/ui/app.py

@@ -944,17 +944,26 @@ def create_app(host: str = "127.0.0.1", port: int = 7860):
 
         from fastapi.responses import StreamingResponse
 
+        from soup_cli.utils.net_guard import refuse_private_ip_literal
+
         # Validate messages
         if not req.messages:
             raise HTTPException(status_code=400, detail="messages cannot be empty")
 
-        # SSRF protection: localhost-only HTTP, HTTPS for remote
-        parsed = urlparse(req.endpoint)
+        # SSRF protection: localhost-only HTTP, HTTPS for remote, and no
+        # private / link-local / reserved IP literal on either scheme.
+        # 0.0.0.0 is the bind-any wildcard, not a loopback address.
+        try:
+            parsed = urlparse(req.endpoint)
+        except ValueError:
+            # e.g. an unbalanced or non-IPv6 bracketed host: a bad request,
+            # not a server error.
+            raise HTTPException(status_code=400, detail="endpoint is not a valid URL") from None
         if parsed.scheme == "http":
             import ipaddress as _ipaddr
 
             host = parsed.hostname or ""
-            is_local = host in ("localhost", "0.0.0.0")
+            is_local = host == "localhost"
             if not is_local:
                 try:
                     addr = _ipaddr.ip_address(host)
@@ -971,6 +980,12 @@ def create_app(host: str = "127.0.0.1", port: int = 7860):
                 status_code=400,
                 detail="Only HTTP (localhost) or HTTPS endpoints allowed",
             )
+        try:
+            refuse_private_ip_literal(parsed.hostname, label="endpoint")
+        except ValueError as exc:
+            # The message is fixed text (the label is a constant); the
+            # endpoint itself is never echoed back.
+            raise HTTPException(status_code=400, detail=str(exc)) from None
 
         # Validate bounds
         if req.max_tokens > 16384:

{soup_cli-0.75.1 → soup_cli-0.75.2}/src/soup_cli/utils/net_guard.py

@@ -46,6 +46,33 @@ import ipaddress
 LOOPBACK_HOSTS = frozenset({"localhost", "127.0.0.1", "::1"})
 
 
+def _ascii_spellings(host: str) -> list[str]:
+    """``host`` plus the ASCII forms an HTTP client may turn it into.
+
+    A client IDNA-encodes a non-ASCII host before it resolves it: urllib and
+    :mod:`socket` through the stdlib codec (IDNA 2003, whose nameprep step
+    NFKC-folds and drops characters such as the soft hyphen), httpx through the
+    ``idna`` package (IDNA 2008). Both treat U+3002, U+FF0E and U+FF61 as label
+    separators, so text that is not an IP literal as written -- ``10.0.0.1``
+    with U+3002 IDEOGRAPHIC FULL STOP in place of each dot, for instance -- can
+    be one once encoded. A form that fails to encode is skipped.
+    """
+    if host.isascii():
+        return [host]
+    spellings = [host]
+    try:
+        spellings.append(host.encode("idna").decode("ascii"))
+    except UnicodeError:
+        pass
+    try:
+        import idna  # noqa: PLC0415 — the encoder httpx uses; optional here
+
+        spellings.append(idna.encode(host.lower()).decode("ascii"))
+    except (ImportError, UnicodeError):  # idna.IDNAError is a UnicodeError
+        pass
+    return spellings
+
+
 def parse_ip_literal(host: str) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None:
     """Parse ``host`` as an IP literal, or ``None`` if it isn't one.
 
@@ -55,7 +82,22 @@ def parse_ip_literal(host: str) -> ipaddress.IPv4Address | ipaddress.IPv6Address
     library :func:`socket.inet_aton`.  The latter is a pure in-process
     string parser — no DNS lookup is performed. A hostname (``"localhost"``,
     ``"evil.example.com"``) returns ``None`` rather than being resolved.
+
+    A non-ASCII host is also read in the ASCII forms a client would connect to
+    (see :func:`_ascii_spellings`), and the first form that is an IP literal is
+    returned, so ``10.0.0.1`` written with ideographic full stops parses as
+    ``10.0.0.1``.
     """
+    for spelling in _ascii_spellings(host):
+        addr = _parse_ascii_ip_literal(spelling)
+        if addr is not None:
+            return addr
+    return None
+
+
+def _parse_ascii_ip_literal(
+    host: str,
+) -> ipaddress.IPv4Address | ipaddress.IPv6Address | None:
     import socket  # noqa: PLC0415 — lazy import (stdlib, negligible cost)
 
     clean_host = host.rstrip(".")
@@ -77,6 +119,13 @@ def is_private_or_link_local(host: str) -> bool:
     multicast / unspecified IP — the union of every guard's policy in this
     repo, since consolidating stops being safe the moment a caller's
     predicate is quietly narrower than the shared one it now uses.
+
+    Also any address ``ipaddress`` does not consider globally reachable
+    (``not is_global``) — that adds RFC 6598 shared address space,
+    ``100.64.0.0/10``, which is neither ``is_private`` nor ``is_global`` —
+    and the deprecated IPv6 site-local block ``fec0::/10``, which
+    ``ipaddress`` still reports as global. ``is_reserved`` stays: NAT64
+    ``64:ff9b::/96`` IS ``is_global``.
     """
     addr = parse_ip_literal(host)
     if addr is None:
@@ -91,4 +140,36 @@ def is_private_or_link_local(host: str) -> bool:
         or addr.is_unspecified
         or addr.is_reserved
         or addr.is_multicast
+        or not addr.is_global
+        or getattr(addr, "is_site_local", False)
     )
+
+
+def refuse_private_ip_literal(host: str | None, *, label: str) -> None:
+    """Raise ``ValueError`` if an outbound endpoint's host is a non-public IP.
+
+    ``host`` is a URL's ``hostname``. It is refused when it is an IP literal, in
+    any spelling :func:`parse_ip_literal` accepts (IPv4-mapped IPv6 included),
+    that :func:`is_private_or_link_local` classifies as non-public, on every
+    scheme. Loopback stays allowed, because a server on the same machine
+    (Ollama, vLLM, ``soup serve``) is a supported target. A hostname passes
+    unchanged and is NOT resolved, so this narrows which addresses a URL can
+    name directly; it does not make internal services unreachable by name. An
+    empty or missing host passes too: the caller's scheme check owns that case.
+    ``label`` names the setting in the message.
+    """
+    clean = (host or "").strip().lower().rstrip(".")
+    if clean.startswith("[") and clean.endswith("]"):
+        clean = clean[1:-1]
+    if not clean or clean in LOOPBACK_HOSTS:
+        return
+    addr = parse_ip_literal(clean)
+    if addr is None:
+        return
+    mapped = getattr(addr, "ipv4_mapped", None)
+    if (mapped if mapped is not None else addr).is_loopback:
+        return
+    if is_private_or_link_local(clean):
+        raise ValueError(
+            f"{label}: private/link-local/reserved IP hosts are not allowed (SSRF protection)"
+        )