Refuse private and loopback targets in fetch_url

[saitej123]

What breaks

fetch_url only checked that the scheme was http or https. That still admits:

• http://127.0.0.1:8111/... (the local gateway and control plane)
• http://169.254.169.254/ (cloud metadata)
• http://192.168.x.x/ and other RFC1918 space

follow_redirects=True meant a public page could bounce the agent onto those addresses after the scheme check had already passed.

A planner that is allowed fetch_url (it is a shipped capability) can therefore read host-local HTTP from a prompt.

Reproduction

On current main this test fails (the URLs are accepted):

uv run pytest tests/test_general_tools.py::test_fetch_url_refuses_private_and_loopback_targets -q

Fix

Resolve the host, refuse loopback / private / link-local / metadata / reserved addresses, and re-check every redirect hop instead of following blindly.

uv run pytest tests/test_general_tools.py passes.

[theschoolofai]

Session 16 — graded ✅

Score: +100.

fetch_url validated only the scheme and then followed redirects with no host check. Confirmed at tools.py:247-253. A confused-deputy fetch of loopback and link-local targets from inside the agent runtime, which is the same class this cohort fixed in the gateway.