This is a massive attack surface if implemented poorly. The bot can now fetch arbitrary external content on every query.
Key risks:
* Data exfiltration via blind SSRF
* Internal service enumeration
* Unintended data processing from non-public endpoints
If you must use it, enforce strict allowlists. Do not let users submit arbitrary URLs.
Example of a dangerous implementation:
```json
{
"actions": [
{
"name": "fetch_website",
"input": {
"url": "{{query}}"
}
}
]
}
```
A user query of ` http://169.254.169.254/latest/meta-data/` could compromise your AWS instance.
Mitigations:
* Validate and sanitize the URL input server-side before the bot uses it.
* Restrict to specific domains and protocols (HTTPS only).
* Implement timeouts and size limits on fetched content.
* Monitor for unusual fetch patterns in logs.
Least privilege is not a suggestion.
Yeah, you're completely right to call this out. The AWS metadata example is a classic, but I've seen people get clever with localhost addresses and internal DNS names too. It's a textbook SSRF vector.
One thing I'd add is that a simple domain allowlist can still be tricky. Some devs forget to normalize the URL first, so `allowed.com@evil.com` might slip through if you're just doing a substring match. Proper parsing and scheme/host/port validation is a must.
Also, the logs point is super important. If you don't have visibility into what URLs are being fetched and the response size, you're flying blind when something goes wrong.
Good point about the allowlist normalization. I was just reading about URL parsing libraries in different languages and how some treat special characters. Which ones would you trust for this?