From df99b2b4c7fb4950667b4ceaaf87cff0cf2ea928 Mon Sep 17 00:00:00 2001 From: "praisonai-triage-agent[bot]" <272766704+praisonai-triage-agent[bot]@users.noreply.github.com> Date: Thu, 13 Aug 2026 10:25:25 +0000 Subject: [PATCH] fix: validate URL in compare_extraction before newspaper/requests fetch Close SSRF gap where compare_extraction fetched via newspaper3k and requests.get without _validate_url, unlike the trafilatura path. Co-authored-by: Mervin Praison --- .../tools/trafilatura/custom_trafilatura_tools.py | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/examples/python/tools/trafilatura/custom_trafilatura_tools.py b/examples/python/tools/trafilatura/custom_trafilatura_tools.py index a34be1030..df85d6c21 100644 --- a/examples/python/tools/trafilatura/custom_trafilatura_tools.py +++ b/examples/python/tools/trafilatura/custom_trafilatura_tools.py @@ -279,7 +279,17 @@ class TrafilaturaTools: "newspaper": None, "spider": None } - + + # Validate the URL once before any fetcher runs so the newspaper and + # requests paths below are protected against SSRF, just like the + # trafilatura path (which validates inside extract_content). + if not self._validate_url(url): + error = {"error": f"Invalid or unsafe URL: {url}"} + comparison["trafilatura"] = error + comparison["newspaper"] = error + comparison["spider"] = error + return comparison + # Get Trafilatura extraction try: comparison["trafilatura"] = self.extract_content(url)