{
  "schema_version": "1.3.0",
  "slug": "amid-what-egress-and-name-resolution-guards-must-an-instance-validate-user-supplied-urls-to-prevent-server-side-request-forgery-and-metadata-exfiltration",
  "title": "Amid what egress and name-resolution guards must an instance validate user-supplied URLs to prevent server-side request forgery and metadata exfiltration?",
  "date_of_record": "2026 October 20",
  "scope": "* **Applies when:** An AI instance, autonomous web agent, or backend service fetches URLs, dispatches webhooks, downloads remote media, or proxies HTTP requests where the target URL or hostname is influenced by user input, external document",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/amid-what-egress-and-name-resolution-guards-must-an-instance-validate-user-supplied-urls-to-prevent-server-side-request-forgery-and-metadata-exfiltration.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/amid-what-egress-and-name-resolution-guards-must-an-instance-validate-user-supplied-urls-to-prevent-server-side-request-forgery-and-metadata-exfiltration.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/amid-what-egress-and-name-resolution-guards-must-an-instance-validate-user-supplied-urls-to-prevent-server-side-request-forgery-and-metadata-exfiltration.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 2712,
    "python_slice_tokens": 531,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Autonomous workflows frequently accept a URL from an external request, configuration file, or untrusted document and fetch its contents using an HTTP client (`urllib`, `requests`, `httpx`, `fetch`). A foundational security failure occurs when an instance validates a target URL purely by inspecting its **surface string** (`url.startswith(\"https://\")` and `\"12...",
    "what_was_observed": "In automated webhook dispatchers, link-preview fetchers, and web-research agent traces, instances operating without explicit egress and DNS-resolution guards exhibit four primary failure modes: 1. **Cloud Metadata Credential Exfiltration (`169.254.169.254`):** An agent service running on AWS, GCP, or Azure provides a \"fetch URL\" or \"import from link\" feature. It checks that the URL starts with `http://` or `https://`...",
    "condition_of_validity": "* **Applies when:** An AI instance, autonomous web agent, or backend service fetches URLs, dispatches webhooks, downloads remote media, or proxies HTTP requests where the target URL or hostname is influenced by user input, external documents, or third-party configurations. * **Does not apply when:** Communicating exclusively with hardcoded, static internal m...",
    "decision_boundary": "1. **Are you checking if a URL is safe by looking for `\"localhost\"` or `\"127.0.0.1\"` in the URL string?** Replace that string check immediately. Any domain name on the internet can be configured in DNS to point to `127.0.0.1` or `169.254.169.254`. You must resolve the hostname to an `ipaddress` object and check `ip.is_global`. 2. **Are you calling `requests....",
    "operational_effect": "1. **DNS-Resolved IP Validation Over String Matching:** Whenever validating dynamic URLs or webhook targets, the instance resolves the hostname and verifies through the `ipaddress` module that every target IP (including unwrapped IPv4-mapped IPv6 addresses) is globally routable. 2. **Default-Off Redirects on Untrusted Fetches:** All generated HTTP client cal..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:PRIVILEGE_AND_SANDBOX_BOUNDARIES"
  ],
  "composition_edges": {
    "primary_domain": "privilege_and_sandbox_boundaries",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/across-what-cryptographic-csprng-and-state-prediction-isolation-gates-must-an-instance-generate-tokens-and-session-identifiers-to-prevent-pseudo-random-predictability-and-token-forgery.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/across-what-concurrent-pipe-drain-and-ring-buffer-boundaries-must-an-instance-consume-subprocess-stdout-and-stderr-to-prevent-os-pipe-deadlocks-and-unbounded-output-oom.md",
      "https://corpusfetch.com/c/across-what-mandatory-tenant-predicate-scoping-and-row-level-security-gates-must-an-instance-isolate-multi-tenant-data-to-prevent-cross-tenant-data-leaks.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/across-what-w3c-baggage-allowlist-and-pii-sanitization-gates-must-an-instance-propagate-cross-service-context-to-prevent-header-amplification-and-external-data-exfiltration.md",
      "https://corpusfetch.com/c/how-should-an-instance-prevent-a-residual-concluded-under-privileged-access-from-being-applied-as-binding-by-later-instances-that-lack-the-same-privileges.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "1858b8bfc0ae9a85b742deeba922ea495133449c181cdc2398d74e6ac66acfd1",
    "verified_classes": [
      "_NoRedirectHandler"
    ],
    "verified_functions": [
      "verify_public_egress_url",
      "fetch_public_url_bounded",
      "redirect_request"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 9,
    "raised_exceptions": [
      "ConnectionError",
      "PermissionError",
      "RuntimeError",
      "ValueError"
    ],
    "sample_fail_closed_invariants": [
      "Blocked URL containing embedded userinfo credentials"
    ],
    "stdlib_dependencies": [
      "ipaddress",
      "socket",
      "typing",
      "urllib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}