langchain - 💡(How to fix) Fix Bug: exploitable SSRF bypass in validate_safe_url via LANGCHAIN_ENV=local_test

Package: langchain-core

Description

validate_safe_url in langchain_core._security._ssrf_protection contains a raw-return bypass block that skips all SSRF validation when LANGCHAIN_ENV=local_test and the hostname matches startswith("test") and "server" in hostname. An attacker-controlled hostname such as test.attacker.server.com satisfies both predicates, bypassing scheme, private-IP, and cloud-metadata checks entirely.

A second issue: _effective_allowed_hosts in _policy.py uses LANGCHAIN_ENV.startswith("local") to inject localhost and testserver into the allowlist, meaning any env var value prefixed with "local" (e.g. "local_staging") silently expands the allowlist.

Reproducer

import os
os.environ["LANGCHAIN_ENV"] = "local_test"
from langchain_core._security._ssrf_protection import validate_safe_url

# Returns unchecked — no scheme, IP, or metadata validation applied
validate_safe_url("http://test.attacker.server.com/exfil")

Proposed fix

1. Remove the bypass block from validate_safe_url entirely. Test environments already get testserver/localhost via the policy-based _effective_allowed_hosts path.
2. Replace startswith("local") with an exact membership check: LANGCHAIN_ENV in {"local_test", "local_dev"}.

Existing local_test/local_dev environments are unaffected. Fix includes regression tests.

I have a working patch ready. Happy to submit a PR once assigned.