fix(ssrf): honor connector loopback policy for A2A agent and PaddleOCR base URLs (#14265)

* fix(ssrf): honor connector loopback policy for A2A agent and PaddleOCR base URLs

The A2A Agent's agent_url and the PaddleOCR bundle's base_url are
flow-author-configured connector endpoints (like the Ollama / LM Studio
base URLs fixed in #14146), but both still used the raw SSRF validator,
so pointing them at a local server (http://localhost:...) was blocked by
default. Route them through validate_and_resolve_connector_url so the
literal-loopback exemption (connector_ssrf_allow_loopback, default on)
applies, while RFC1918 / link-local / cloud-metadata targets stay
blocked and non-exempt hosts keep DNS pinning.

Remote-controlled URLs keep the strict validator: A2A card-declared
off-origin hops (including the toggle-independent floor) and the
PaddleOCR result_url from the job-status response are unchanged, so a
remote response cannot ride the loopback exemption.

Related to #14264 (same regression family as the LM Studio report);
follow-up to #14146.

* [autofix.ci] apply automated fixes

* chore(paddle): bump lfx-paddle to 0.1.2 so the SSRF fix ships

lfx-paddle 0.1.0 and 0.1.1 are already published on PyPI (0.1.1 from
the 1.12 line, without this fix), and release_bundles.yml skips
already-published versions — without a bump the connector-loopback fix
would never reach the published wheel that langflow resolves at install
time. 0.1.1 is skipped because that version number is already taken on
PyPI by a build without this change.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

Author: erichare

src/bundles/paddle/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lfx-paddle"
-version = "0.1.0"
+version = "0.1.2"
 description = "PaddleOCR component (OCR and layout-aware document parsing via the AI Studio async Job API) as a standalone Langflow Extension Bundle."
 readme = "README.md"
 requires-python = ">=3.10,<3.15"

src/bundles/paddle/src/lfx_paddle/components/paddle/paddleocr.py

@@ -8,7 +8,11 @@
 from lfx.base.data.base_file import BaseFileComponent
 from lfx.inputs.inputs import BoolInput, DropdownInput, FloatInput, IntInput, MessageTextInput, SecretStrInput
 from lfx.schema.data import Data
-from lfx.utils.ssrf_protection import is_ssrf_protection_enabled, validate_and_resolve_url
+from lfx.utils.ssrf_protection import (
+    is_ssrf_protection_enabled,
+    validate_and_resolve_connector_url,
+    validate_and_resolve_url,
+)
 from lfx.utils.ssrf_transport import create_ssrf_protected_sync_client
 
 if TYPE_CHECKING:
@@ -209,12 +213,16 @@ def process_files(self, file_list: list[BaseFileComponent.BaseFile]) -> list[Bas
         }
         poll_timeout = int(self.poll_timeout or 600)
 
-        # ``base_url`` is operator-configurable, so the submit and poll requests
-        # (which carry the bearer token and the uploaded file) are validated for
-        # SSRF up front and DNS-pinned for the rest of the run.  Like
-        # ``_fetch_result``, this is a no-op when SSRF protection is disabled
-        # (the default), so default behavior is unchanged.
-        _validated_url, base_ips = validate_and_resolve_url(base_url)
+        # ``base_url`` is configured by the flow author (a self-hosted PaddleOCR
+        # service on localhost is a legitimate deployment), so the submit and
+        # poll requests (which carry the bearer token and the uploaded file)
+        # follow the connector SSRF policy: a literal loopback host is allowed
+        # by default (``connector_ssrf_allow_loopback``) while RFC1918 /
+        # link-local / cloud-metadata targets stay blocked; non-exempt hosts
+        # are DNS-pinned for the rest of the run.  ``result_url`` in
+        # ``_fetch_result`` comes from the remote response instead and keeps
+        # the strict validator.
+        _validated_url, base_ips = validate_and_resolve_connector_url(base_url)
 
         try:
             for file in file_list:

src/bundles/paddle/src/lfx_paddle/extension.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schemas.langflow.org/extension/v1.json",
   "id": "lfx-paddle",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "name": "PaddleOCR",
   "description": "PaddleOCR component (OCR and layout-aware document parsing via the AI Studio async Job API) as a standalone Langflow Extension Bundle.",
   "lfx": {

src/bundles/paddle/tests/test_paddleocr_component.py

@@ -276,6 +276,66 @@ def fake_validate(url):
         component._fetch_result("http://169.254.169.254/latest/meta-data/")
 
 
+def test_paddleocr_loopback_base_url_allowed_by_default(monkeypatch, tmp_path):
+    # SSRF protection on, no allowlist: a self-hosted PaddleOCR service on
+    # localhost passes the connector policy (literal-loopback exemption), so
+    # processing proceeds to the (stubbed) submit/poll calls. Regression guard
+    # for the #14264 family (local services blocked at loopback by the raw
+    # validator).
+    monkeypatch.setenv("LANGFLOW_SSRF_PROTECTION_ENABLED", "true")
+    monkeypatch.delenv("LANGFLOW_SSRF_ALLOWED_HOSTS", raising=False)
+    monkeypatch.delenv("LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK", raising=False)
+
+    file_path = tmp_path / "sample.png"
+    file_path.write_bytes(b"fake image")
+
+    monkeypatch.setattr(PaddleOCRComponent, "_submit_job", lambda _self, **_kwargs: "job-id")
+    monkeypatch.setattr(
+        PaddleOCRComponent,
+        "_poll_job",
+        lambda _self, **_kwargs: [{"result": {"ocrResults": [{"prunedResult": {"rec_texts": ["ok"]}}]}}],
+    )
+
+    component = PaddleOCRComponent()
+    component.set_attributes(
+        {
+            "access_token": "token",
+            "base_url": "http://127.0.0.1:8868",
+            "task_type": "ocr",
+            "model": "PP-OCRv6",
+            "poll_timeout": 60,
+        }
+    )
+    result = component.process_files([make_base_file(file_path)])
+    assert result[0].data[0].data["text"] == "ok"
+
+
+def test_paddleocr_loopback_base_url_blocked_when_connector_loopback_disabled(monkeypatch, tmp_path):
+    # Multi-tenant posture: connector_ssrf_allow_loopback=false blocks the
+    # loopback base_url before any request is made.
+    from lfx.utils.ssrf_protection import SSRFProtectionError
+
+    monkeypatch.setenv("LANGFLOW_SSRF_PROTECTION_ENABLED", "true")
+    monkeypatch.setenv("LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK", "false")
+    monkeypatch.delenv("LANGFLOW_SSRF_ALLOWED_HOSTS", raising=False)
+
+    file_path = tmp_path / "sample.png"
+    file_path.write_bytes(b"fake image")
+
+    component = PaddleOCRComponent()
+    component.set_attributes(
+        {
+            "access_token": "token",
+            "base_url": "http://127.0.0.1:8868",
+            "task_type": "ocr",
+            "model": "PP-OCRv6",
+            "poll_timeout": 60,
+        }
+    )
+    with pytest.raises(SSRFProtectionError, match="blocked"):
+        component.process_files([make_base_file(file_path)])
+
+
 def test_fetch_result_parses_json_list(monkeypatch):
     component = PaddleOCRComponent()
 

src/lfx/src/lfx/_assets/component_index.json

@@ -30,6 +30,7 @@
     is_host_allowed,
     is_ip_blocked,
     resolve_hostname,
+    validate_and_resolve_connector_url,
     validate_and_resolve_url,
 )
 from lfx.utils.ssrf_transport import SSRFProtectedTransport
@@ -409,8 +410,10 @@ async def _fetch_card(self, url: str) -> dict | None:
         """
         base = _agent_base_url(url)
         try:
-            # to_thread: validate_and_resolve_url does blocking DNS; keep it off the event loop.
-            _validated_url, validated_ips = await asyncio.to_thread(validate_and_resolve_url, base)
+            # Connector policy (the URL is flow-author-configured, like the Ollama / LM Studio
+            # base URLs): literal loopback allowed by default, internal ranges still blocked.
+            # to_thread: the validator does blocking DNS; keep it off the event loop.
+            _validated_url, validated_ips = await asyncio.to_thread(validate_and_resolve_connector_url, base)
         except SSRFProtectionError:
             return None
         try:
@@ -622,11 +625,15 @@ async def _call_external_agent(self) -> Message:
         # from <base>/.well-known/agent-card.json, so normalize first to avoid double-appending.
         agent_url = _agent_base_url(self.agent_url)
 
-        # Validate + DNS-pin the agent URL before any outbound call (blocks loopback, RFC1918,
-        # link-local / cloud metadata, etc.); mirrors the API Request component.
+        # Validate + DNS-pin the agent URL before any outbound call. The agent URL is configured
+        # by the flow author (like the Ollama / LM Studio base URLs), so it follows the connector
+        # policy: a literal loopback host is allowed by default (connector_ssrf_allow_loopback)
+        # while RFC1918 / link-local / cloud-metadata targets stay blocked. Card-declared
+        # off-origin hops are remote-controlled and keep the strict validator plus the
+        # toggle-independent floor (see build_a2a_client).
         try:
-            # to_thread: validate_and_resolve_url does blocking DNS; keep it off the event loop.
-            _validated_url, validated_ips = await asyncio.to_thread(validate_and_resolve_url, agent_url)
+            # to_thread: the validator does blocking DNS; keep it off the event loop.
+            _validated_url, validated_ips = await asyncio.to_thread(validate_and_resolve_connector_url, agent_url)
         except SSRFProtectionError as e:
             msg = f"SSRF Protection: {e}"
             raise ValueError(msg) from e

src/lfx/src/lfx/components/models_and_agents/a2a_agent.py

@@ -36,8 +36,8 @@ class SecuritySettings(BaseModel):
     """SSRF validation for CONNECTOR components that take a tenant-controlled host/URL:
     vector stores (Chroma/Qdrant/Elasticsearch/OpenSearch/Milvus/Weaviate/Supabase/Upstash/
     ClickHouse), the SQL Database components, the Glean and AstraDB-CQL tools, model-provider
-    model discovery (LiteLLM/HuggingFace/xAI/DeepSeek/Groq/watsonx), and the Ollama / LM Studio /
-    Home Assistant base-URL fields.
+    model discovery (LiteLLM/HuggingFace/xAI/DeepSeek/Groq/watsonx), the Ollama / LM Studio /
+    Home Assistant base-URL fields, the A2A Agent agent URL, and the PaddleOCR base URL.
 
     Default True: connector host validation follows ssrf_protection_enabled / ssrf_allowed_hosts
     so tenant-controlled connector URLs cannot reach internal/cloud-metadata hosts by default.

src/lfx/src/lfx/services/settings/groups/security.py

@@ -9,7 +9,10 @@
 - it strips the configured ``x-api-key`` on any off-origin hop (a card declaring an RPC url
   on a different host/port), so the key can never leak there, while still SSRF-validating that
   off-origin target (an internal/metadata target is blocked),
-- an internal/loopback ``agent_url`` is rejected by SSRF protection before any call.
+- an internal/metadata ``agent_url`` is rejected by SSRF protection before any call, while a
+  literal-loopback ``agent_url`` follows the connector policy (allowed by default for local
+  agents, blocked when ``connector_ssrf_allow_loopback`` is off) without weakening the strict
+  validation of card-declared off-origin targets.
 """
 
 import contextlib
@@ -208,8 +211,12 @@ async def test_off_origin_idn_host_pinned_under_punycode_key(monkeypatch):
     assert "exämple.com" not in client._transport.pinned_ips
 
 
-async def test_loopback_agent_url_rejected_by_ssrf(monkeypatch):
-    """A loopback / metadata agent_url is rejected before any outbound call."""
+async def test_metadata_agent_url_rejected_by_ssrf(monkeypatch):
+    """An internal/metadata agent_url is rejected before any outbound call.
+
+    The connector loopback exemption only covers literal loopback hosts; cloud-metadata and
+    RFC1918 targets stay blocked regardless.
+    """
     monkeypatch.setenv("LANGFLOW_SSRF_PROTECTION_ENABLED", "true")
     monkeypatch.delenv("LANGFLOW_SSRF_ALLOWED_HOSTS", raising=False)
 
@@ -221,6 +228,54 @@ async def test_loopback_agent_url_rejected_by_ssrf(monkeypatch):
         await component.send_to_agent()
 
 
+async def test_loopback_agent_url_allowed_by_default_connector_policy(monkeypatch):
+    """A literal-loopback agent_url follows the connector policy: allowed by default.
+
+    The agent URL is flow-author-configured (like the Ollama / LM Studio base URLs), so a local
+    A2A server is reachable out of the box — no allowlist entry required. Regression guard for
+    the #14264 family (local services blocked at loopback by the raw validator).
+    """
+    monkeypatch.setenv("LANGFLOW_SSRF_PROTECTION_ENABLED", "true")
+    monkeypatch.delenv("LANGFLOW_SSRF_ALLOWED_HOSTS", raising=False)
+    monkeypatch.delenv("LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK", raising=False)
+
+    with _CardServer() as server:
+        component = A2AAgentComponent(mode="External", agent_url=f"http://127.0.0.1:{server.port}", input_value="hi")
+        card = await component._fetch_card(f"http://127.0.0.1:{server.port}")
+
+    assert card is not None
+    assert card["name"] == "Echo"
+
+
+async def test_loopback_agent_url_blocked_when_connector_loopback_disabled(monkeypatch):
+    """Multi-tenant posture: connector_ssrf_allow_loopback=false blocks a loopback agent_url."""
+    monkeypatch.setenv("LANGFLOW_SSRF_PROTECTION_ENABLED", "true")
+    monkeypatch.setenv("LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK", "false")
+    monkeypatch.delenv("LANGFLOW_SSRF_ALLOWED_HOSTS", raising=False)
+
+    component = A2AAgentComponent(agent_url="http://127.0.0.1:9", input_value="hi")
+    with pytest.raises(ValueError, match="SSRF"):
+        await component.send_to_agent()
+
+
+async def test_off_origin_loopback_still_blocked_despite_connector_exemption(monkeypatch):
+    """The connector loopback exemption applies only to the flow-author's agent_url.
+
+    A card-declared off-origin hop to loopback stays on the strict validator: without an
+    allowlist entry it is blocked, so a remote card cannot ride the exemption to reach the
+    server's loopback.
+    """
+    monkeypatch.setenv("LANGFLOW_SSRF_PROTECTION_ENABLED", "true")
+    monkeypatch.delenv("LANGFLOW_SSRF_ALLOWED_HOSTS", raising=False)
+    monkeypatch.delenv("LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK", raising=False)
+
+    agent_url = "http://public-agent.example"  # off-origin hop below differs by host
+    client = build_a2a_client(agent_url, ["93.184.216.34"], api_key="super-secret", timeout=2)
+    async with client:
+        with pytest.raises(SSRFProtectionError):
+            await client.post("http://127.0.0.1:9/rpc", json={"hello": "world"})
+
+
 # --- External mode: agent card preview -------------------------------------