[dezren39]

Problem

fetchFollowingValidatedRedirects (the Worker-fallback crawler's SSRF guard from PR #461, fixing #460) validated every redirect target with validateCrawlUrl — but fetched its startUrl argument without validating it at all. The fetching component did not enforce the #441 policy itself; it relied entirely on its one current caller pre-validating. Any future caller, or a refactor dropping the handler's rewrite, silently re-opens the #460/#441 SSRF on hop 0. Reproduced on main 468b9155: fetchFollowingValidatedRedirects("http://127.0.0.1/secret", stub) fetched the URL and returned its 200 body.

Solution

Validate startUrl with validateCrawlUrl at entry: throw refusing to crawl <url>: <reason> before fetching anything for a non-public / non-http(s) start, and make the first fetch use the validated/normalised URL. Redirect hops are unchanged. This matches the container crawler's stated design (the component that actually fetches re-validates independently, defence in depth) and breaks no current caller — the /api/crawl handler's URL is already validated/normalised.

Verification

• New regression test: 7 blocked start forms (127.0.0.1, 169.254.169.254, integer-IPv4 2130706433, IPv4-mapped [::ffff:127.0.0.1], localhost, file:, junk) are refused with the fetcher never invoked. Ablation-verified: fails pre-fix (9 pass / 1 fail), passes post-fix.
• npm test: 10/10 (existing public-start redirect tests unchanged and passing).
• tsc --noEmit: clean.
• Diff is exactly the two lab-ops-hub files (+28/−3). Single-repo: lab-ops-hub exists only in developing-today/code.

Fixes #464

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ffb7ef01-1b9b-44bd-b13d-3263907174cf

📥 Commits

Reviewing files that changed from the base of the PR and between 468b915 and 998ab87.

📒 Files selected for processing: 2

• pkgs/lab-ops-hub/src/lib.ts
• pkgs/lab-ops-hub/test/lib.test.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-21T08:00:33.943359Z	998ab87	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.