mirror of
https://github.com/bytedance/deer-flow.git
synced 2026-11-12 22:20:33 +00:00
70a4b83907
* fix(community): return an error for malformed URLs in the SSRF guard validate_public_http_url and validate_delegated_backend_url document returning an "Error: ..." string, but urlparse() raises ValueError for malformed authorities such as http://[::1/api, so the exception escaped to callers (web_fetch/web_capture, browser_navigate, personal MCP, and the browser stream navigation check) instead of a clean validation error. Parse through a small _parse_url helper that returns None for malformed input (including non-string values), and treat a raw bracket in the userinfo slot as malformed on every Python version, mirroring the SkillScan host parser merged in #8017. The only URLs newly rejected are userinfo values containing a raw bracket, which RFC 3986 forbids; no valid host becomes unreachable and fail-closed behavior is otherwise unchanged. * test(community): share malformed URL cases and add changelog entry Drive both validators' malformed-URL parametrization from one list, and document the contract fix in the Unreleased Fixed section (#8079). --------- Co-authored-by: Willem Jiang <willem.jiang@gmail.com>