freedak/Scrapling
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): default follow_redirects to "safe" for SSRF protection

Browse Source 
curl_cffi v0.15.0 introduced CurlFollow.SAFE, which follows redirects but rejects those targeting internal/private IPs (loopback, private networks, link-local). This is now the default for all HTTP fetchers, the MCP server, and the shell curl converter.

Added FollowRedirects type alias supporting all curl_cffi redirect
modes: bool, "safe", "all", "obeycode", "firstonly".
This commit is contained in:
Karim shoair
2026-04-05 18:41:50 +02:00
parent 065bf1c0e8
commit e7f9adb40a
6 changed files with 23 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scrapling/core/shell.py
+1 -1
View File
@@ -294,7 +294,7 @@ class CurlParser:
headers=headers,
cookies=cookies,
proxy=proxies,
follow_redirects=True, # Scrapling default is True
follow_redirects="safe", # Follows redirects but rejects those to internal/private IPs
)
def convert2fetcher(self, curl_command: Request | str) -> Optional[Response]: