fix(tools): block CGNAT and non-global IPs in validate_url

[SashaMIT]

Summary

Sibling of #6870. Shared validate_url (used by host scrapers via safe_get, and by Selenium once #6870 lands) only checked a hand-maintained IPv4 list. That list missed:

• CGNAT / shared address space 100.64.0.0/10 (is_private is False there)
• Documentation / benchmarking / Class E style non-global ranges
• The rest of 0.0.0.0/8 beyond 0.0.0.0/32

So a prompt-injected scrape URL to e.g. http://100.64.0.1/ passed validation at tip 92012aec.

Fix

• Treat any address with not ipaddress…is_global as blocked (covers CGNAT)
• Keep explicit networks as belt-and-suspenders; expand 0.0.0.0/8 and add 100.64.0.0/10

Testing

uv run pytest tests/utilities/test_safe_path.py → 36 passed (new CGNAT / 198.18 / 192.0.2 / 0.0.0.1 cases).

Made with Cursor

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d0365dbf-6641-4a89-8e45-c76789ef53e8

📥 Commits

Reviewing files that changed from the base of the PR and between f7ba8e3 and 05c67d4.

📒 Files selected for processing (2)

• lib/crewai-tools/src/crewai_tools/security/safe_path.py
• lib/crewai-tools/tests/utilities/test_safe_path.py

🚧 Files skipped from review as they are similar to previous changes (1)

• lib/crewai-tools/src/crewai_tools/security/safe_path.py

---

📝 Walkthrough

Walkthrough

Changes

Safe URL IP validation

Layer / File(s)	Summary
Global address classification and blocklists lib/crewai-tools/src/crewai_tools/security/safe_path.py	The IPv4 blocklist now includes 0.0.0.0/8 and 100.64.0.0/10. Validation rejects multicast and non-global addresses, including IPv4 values embedded in mapped and NAT64 IPv6 addresses.
Special-use URL validation tests lib/crewai-tools/tests/utilities/test_safe_path.py	Tests verify rejection of CGNAT, multicast, NAT64 embedded link-local and loopback addresses, benchmarking, documentation, and 0.0.0.0/8 addresses.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: blocking CGNAT and other non-global IPs in validate_url.
Description check	✅ Passed	The description directly explains the validate_url security changes, affected IP ranges, NAT64 and multicast handling, and regression tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

lib/crewai-tools/tests/utilities/test_safe_path.py (1)

157-173: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a regression test for Class E addresses.

The new tests cover CGNAT, benchmarking, documentation, and 0.0.0.0/8, but they do not cover the Class E range that _is_private_or_reserved now claims to reject. Add a behavior test for 240.0.0.1 with the same ValueError assertion.

Suggested regression test

+    def test_blocks_class_e(self):
+        with pytest.raises(ValueError, match="private/reserved IP"):
+            validate_url("http://240.0.0.1/")

As per coding guidelines, **/*test*.py: Write unit tests for new functionality, focusing on behavior rather than implementation details. The PR objective includes Class E-style ranges in the addresses that validate_url must reject.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@lib/crewai-tools/tests/utilities/test_safe_path.py` around lines 157 - 173,
Add a regression test alongside the existing reserved-address tests that calls
validate_url with http://240.0.0.1/ and asserts ValueError matching
"private/reserved IP", covering rejection of Class E addresses.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@lib/crewai-tools/tests/utilities/test_safe_path.py`:
- Around line 157-173: Add a regression test alongside the existing
reserved-address tests that calls validate_url with http://240.0.0.1/ and
asserts ValueError matching "private/reserved IP", covering rejection of Class E
addresses.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1a83de09-c7a4-423a-a01e-1163937b6abd

📥 Commits

Reviewing files that changed from the base of the PR and between 92012ae and ccc3bb1.

📒 Files selected for processing (2)

• lib/crewai-tools/src/crewai_tools/security/safe_path.py
• lib/crewai-tools/tests/utilities/test_safe_path.py

[manjunathbhaskar]

the is_global check you just added (safe_path.py:182ish) does not catch multicast — 224.0.0.1, 239.255.255.250 still get through since ipaddress reports is_global=True for multicast.

also 64:ff9b::/96 (NAT64 prefix) reads as global even when it's wrapping 169.254.169.254 or 127.0.0.1 underneath:

ipaddress.ip_address("64:ff9b::a9fe:a9fe").is_global -> True

same unwrap trick you're doing for ::ffff:.../96 a few lines up would work here too, plus an is_multicast check. worth folding in before merge.

[SashaMIT]

Good catch @manjunathbhaskar — folded in on 05c67d4:

• reject is_multicast (covers 224.0.0.1 / 239.255.255.250)
• unwrap well-known NAT64 64:ff9b::/96 the same way as ::ffff: so embeds like 64:ff9b::a9fe:a9fe (169.254.169.254) fail closed

Added regression tests for both. Ready for another look.