fix(provider-utils): scope download credentials and pin per-URL, not per-config

Two trust-boundary gaps in the SSRF guard, both reachable:

1. The first request sent caller headers (which may carry the provider
   API key) to whatever public host the response body named; cross-origin
   clearing only ran after a redirect. Now credentials are sent only when
   the target is on the configured base_url's origin or a same-scheme
   sibling under its parent domain (api.us1.bfl.ai for api.bfl.ai), gated
   before the first request and derived from config, never the response.

2. proxy_in_use() was a global boolean, so a request that a proxy would
   actually send DIRECT (NO_PROXY match, or HTTP-only proxy for an HTTPS
   URL) skipped DNS pinning and reopened the rebinding hole. The pinned
   client now applies the proxy config and lets reqwest decide per URL:
   proxied requests are resolved by that trusted transport, direct ones
   stay pinned to the validated addresses.

Also allow clippy 1.98's chunks_exact_to_as_chunks in hash.rs and
openai/embedding.rs, and result_large_err in ws.rs (suggested APIs
exceed the 1.85 MSRV / boxing an immediately-consumed internal error).

Author: cunninghamcard-bit

CHANGELOG.md

@@ -18,10 +18,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   connection pinned to the validated addresses (defeating TTL-0 DNS
   rebinding), per-hop re-validation of redirects, rejection of redirects to
   non-HTTP(S) schemes, and sanitization of hop-by-hop/forwarding/metadata
-  headers. URLs same-origin with the configured `base_url` are exempt so
-  self-hosted deployments keep working; when a proxy is configured the
-  proxied client is used (pinning is impossible through a proxy) while URL
-  and DNS validation still apply. Wired into every response-body-URL fetch:
+  headers. Caller headers (which may carry the provider API key) are sent
+  only when the target is on the configured `base_url`'s origin or a sibling
+  host under its parent domain, so a response cannot point credentials at an
+  arbitrary public host. URLs same-origin with the configured `base_url` are
+  exempt from address validation so self-hosted deployments keep working;
+  proxy routing is decided per URL by reqwest itself — requests a proxy
+  carries are resolved by that trusted transport, while requests that go
+  direct (NO_PROXY match, or no proxy for the scheme) stay pinned to the
+  validated addresses. Wired into every response-body-URL fetch:
   Black Forest Labs (polling + download), Gladia (result polling), Luma,
   Recraft, Replicate, and fal image downloads, and the Google Files upload
   URL.

aimux-provider-utils/src/download_guard.rs

@@ -33,6 +33,44 @@ pub(crate) fn hop_trusted_origin<'a>(
     trusted_origin.filter(|origin| same_origin(current_url, origin))
 }
 
+/// Whether caller headers (which may carry credentials) may be sent to `url`:
+/// same origin as the trusted origin, or a same-scheme sibling host under the
+/// trusted origin's parent domain — providers routinely serve polling URLs
+/// from regional hosts (api.us1.bfl.ai for a base of api.bfl.ai). The parent
+/// must keep at least two labels so an apex base never widens the trust to a
+/// public suffix, and trust always derives from the configured origin, never
+/// from the response.
+pub(crate) fn credential_eligible(url: &str, trusted_origin: Option<&str>) -> bool {
+    let Some(origin) = trusted_origin else {
+        return false;
+    };
+    if same_origin(url, origin) {
+        return true;
+    }
+    let (Ok(url), Ok(origin)) = (url::Url::parse(url), url::Url::parse(origin)) else {
+        return false;
+    };
+    if url.scheme() != origin.scheme() {
+        return false;
+    }
+    let (Some(host), Some(origin_host)) = (url.host_str(), origin.host_str()) else {
+        return false;
+    };
+    // IP-literal origins have no domain family; only an exact origin match
+    // (handled above) qualifies. Otherwise "127.0.0.1" would parse a bogus
+    // "0.0.1" parent and treat every 127.* port as a sibling.
+    if origin_host.parse::<IpAddr>().is_ok() {
+        return false;
+    }
+    let Some((_, parent)) = origin_host.split_once('.') else {
+        return false;
+    };
+    parent.contains('.')
+        && host.len() > parent.len()
+        && host.ends_with(parent)
+        && host.as_bytes()[host.len() - parent.len() - 1] == b'.'
+}
+
 fn without_query(parsed: &url::Url) -> String {
     let mut redacted = parsed.clone();
     redacted.set_query(None);
@@ -406,6 +444,49 @@ mod tests {
         assert!(addresses.is_empty());
     }
 
+    #[test]
+    fn credentials_stay_within_the_trusted_origin_family() {
+        let base = Some("https://api.bfl.ai");
+        // Same origin and same-parent-domain siblings are eligible.
+        assert!(credential_eligible(
+            "https://api.bfl.ai/v1/get_result",
+            base
+        ));
+        assert!(credential_eligible(
+            "https://api.us1.bfl.ai/v1/get_result",
+            base
+        ));
+        // Foreign hosts, lookalike suffixes, scheme downgrades, and
+        // response-chosen public hosts are not.
+        assert!(!credential_eligible("https://attacker.example/poll", base));
+        assert!(!credential_eligible("https://evil-bfl.ai/poll", base));
+        assert!(!credential_eligible("http://api.us1.bfl.ai/poll", base));
+        assert!(!credential_eligible("https://api.bfl.ai/x", None));
+        // An apex base must not widen trust to the entire public suffix.
+        assert!(!credential_eligible(
+            "https://other.ai/poll",
+            Some("https://bfl.ai")
+        ));
+        // A deeper base widens only to its own organization's domain.
+        assert!(credential_eligible(
+            "https://cdn.example.co.uk/file",
+            Some("https://api.example.co.uk")
+        ));
+        assert!(!credential_eligible(
+            "https://evil.co.uk/file",
+            Some("https://api.example.co.uk")
+        ));
+        // An IP-literal origin has no domain family: only the exact origin.
+        assert!(credential_eligible(
+            "http://127.0.0.1:8080/file",
+            Some("http://127.0.0.1:8080")
+        ));
+        assert!(!credential_eligible(
+            "http://127.0.0.1:9090/file",
+            Some("http://127.0.0.1:8080")
+        ));
+    }
+
     #[test]
     fn trusted_origin_does_not_extend_to_foreign_hops() {
         let trusted = Some("http://localhost:43123");

aimux-provider-utils/src/http.rs

@@ -270,10 +270,16 @@ fn pinned_client(url: &str, addresses: &[std::net::IpAddr]) -> Result<Client, Ai
         .ok_or_else(|| AiMuxError::Other("download url has no host".to_string()))?
         .to_string();
     let port = parsed.port_or_known_default().unwrap_or(80);
-    let mut b = client_builder(&PoolConfig::default(), &TimeoutConfig::default(), false)
-        // A proxy resolves and connects to the target independently, which
-        // would bypass the validated address binding below.
-        .no_proxy();
+    // The proxy configuration is applied so reqwest makes the per-URL
+    // routing decision itself: when a proxy carries the request the proxy
+    // resolves the target (a trusted transport, the override below is
+    // unused), and any request the proxy rules send DIRECT — a NO_PROXY
+    // match, or no proxy configured for the URL's scheme — still connects
+    // only through the validated, pinned addresses.
+    let mut b = apply_proxy(
+        client_builder(&PoolConfig::default(), &TimeoutConfig::default(), false),
+        &global_proxy(),
+    );
     let socket_addresses: Vec<_> = addresses
         .iter()
         .map(|address| std::net::SocketAddr::new(*address, port))
@@ -284,25 +290,6 @@ fn pinned_client(url: &str, addresses: &[std::net::IpAddr]) -> Result<Client, Ai
     })
 }
 
-/// Whether any proxy could carry outbound traffic: an explicit `init_proxy`
-/// configuration, or the environment variables reqwest reads by default.
-fn proxy_in_use() -> bool {
-    let proxy = global_proxy();
-    proxy.http_url.is_some()
-        || proxy.https_url.is_some()
-        || proxy.all_url.is_some()
-        || [
-            "HTTPS_PROXY",
-            "https_proxy",
-            "HTTP_PROXY",
-            "http_proxy",
-            "ALL_PROXY",
-            "all_proxy",
-        ]
-        .iter()
-        .any(|name| std::env::var_os(name).is_some_and(|value| !value.is_empty()))
-}
-
 /// Apply proxy configuration to a reqwest client builder (by-value chain).
 fn apply_proxy(b: reqwest::ClientBuilder, proxy: &ProxyConfig) -> reqwest::ClientBuilder {
     use reqwest::Proxy as ReqwestProxy;
@@ -1517,19 +1504,25 @@ async fn send_validated_redirects(
 ) -> Result<reqwest::Response, AiMuxError> {
     let mut current = request.clone();
     crate::download_guard::sanitize_download_headers(&mut current.headers);
+    // Caller headers may carry credentials (providers poll response-supplied
+    // URLs with their API key); a response must not be able to point them at
+    // an arbitrary public host. Trust derives from the configured origin, so
+    // anything outside its domain gets only a User-Agent.
+    if !crate::download_guard::credential_eligible(&current.url, trusted_origin) {
+        crate::download_guard::retain_user_agent(&mut current.headers);
+    }
     let mut pinned =
         crate::download_guard::validate_download_target(&current.url, trusted_origin).await?;
     for redirect_count in 0..=10 {
         let hop_client;
-        let client: &Client = if pinned.is_empty() || proxy_in_use() {
-            // Empty pins mean the hop is on the trusted origin. A proxy
-            // resolves and connects to the target itself, so pinning is
-            // structurally impossible through one; the URL and its DNS
-            // answers were still validated above.
+        let client: &Client = if pinned.is_empty() {
+            // Empty pins mean the hop is on the trusted origin.
             download_client()?
         } else {
-            // DNS answers were validated; pin them so the actual connection
-            // can only reach the addresses that passed the guard.
+            // DNS answers were validated; pin them so a direct connection
+            // can only reach the addresses that passed the guard. When a
+            // configured proxy carries the request instead, the proxy
+            // resolves the target and the pin is deliberately unused.
             hop_client = pinned_client(&current.url, &pinned)?;
             &hop_client
         };

aimux-provider-utils/src/ws.rs

@@ -86,6 +86,9 @@ enum ConnectError {
     Tungstenite(tokio_tungstenite::tungstenite::Error),
 }
 
+// Clippy 1.98 flags the 136-byte tungstenite error variant; this internal
+// error is consumed immediately by the one caller, so boxing buys nothing.
+#[allow(clippy::result_large_err)]
 async fn connect_with_timeout(
     request: tokio_tungstenite::tungstenite::http::Request<()>,
     timeout: Option<std::time::Duration>,

aimux-providers/src/openai/embedding.rs

@@ -220,6 +220,10 @@ fn decode_base64_embedding(s: &str) -> Option<Vec<f32>> {
     if bytes.len() % 4 != 0 {
         return None;
     }
+    // Clippy 1.98 suggests `as_chunks::<4>()`, which is stable only since
+    // Rust 1.88; the workspace MSRV is 1.85. `unknown_lints` keeps this
+    // buildable on toolchains older than the lint itself.
+    #[allow(unknown_lints, clippy::chunks_exact_to_as_chunks)]
     Some(
         bytes
             .chunks_exact(4)