fix: validate every redirect hop before fetching InputFile URLs

[abnegate]

Problem

Hosted InputFile URL fetches (_fetch_input_file) validated the caller-supplied URL, then let httpx follow redirects automatically and only re-checked resp.url after the final request had already been sent. A public host that answered 302 Location: http://169.254.169.254/... (or loopback / RFC1918) made the server issue a GET to that internal address. The post-fetch check discarded the body, but the request had already happened.

Fetch failures were also an oracle: a blocked internal hop, an HTTP error, and a connection failure each produced different caller-visible text, and httpx errors included the final URL and status code.

Fix

• Disable automatic redirects and follow Location manually up to the existing FETCH_MAX_REDIRECTS cap.
• Resolve and validate every hop (initial URL and each Location, including relative ones via urljoin) before opening a connection to that hop.
• Pin TCP to the IP just validated and keep the original hostname as Host and TLS sni_hostname, so HTTPS certificate verification is unchanged and the resolve-then-reconnect DNS-rebinding window is closed.
• Preserve the existing size cap, timeout, redirect cap, and filename derivation for legitimate public URLs.
• Map redirect / HTTP / connection failures to a single generic caller-visible message. Specific validation errors remain only for the caller-supplied URL (scheme, DNS, private). Details stay in server logs.

Tests

Unit coverage in tests/unit/test_server.py:

• Public → loopback / private / link-local redirect is refused and a local internal listener receives no request
• Direct public URL and public → public redirect still work (mocked client and local HTTP servers)
• Relative Location is joined against the logical hostname, not the pinned IP
• Redirect cap still enforced
• HTTP errors, connection errors, and blocked redirect hops all return the same generic message
• DNS / getaddrinfo is mocked; tests do not use the public internet

Checks

ruff, black --check, pyright, and python -m unittest discover -s tests/unit pass locally.

  

[hansi-codes]

🟢 Tier S · Ready to merge

This change replaces automatic redirects in InputFile URL downloads with manually validated, IP-pinned hops and generic fetch-failure messages. It also adds unit coverage for redirect safety, successful downloads, redirect limits, and failure-message consistency.

Latest changes: The newest commits reuse the webhook egress policy for IP routability checks and add coverage for carrier-grade NAT and NAT64 addresses.

Verdict	New comments	Fixed	Still open
💬 Commented	0	0	0

📂 Walkthrough · 2

File	Change
src/mcp_server_appwrite/server.py	Adds IP-pinned fetch targets, validates each redirect before connecting, and normalizes fetch failures.
tests/unit/test_server.py	Covers redirect validation, pinned requests, successful public redirects, and generic errors.

---

_{Reviewed the commits since 7558ab0 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🟡 Tier B · 1 blocking finding to address. Summary

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary

The findings that requested changes are resolved. See the summary comment for what is still open.