fix: URLAllowList inspects URLs nested inside containers

[higagan]

Version → 0.3.4.

The gap

0.3.2 taught URLAllowList to return None for non-string values, so it could coexist on a multi-argument tool like http_post(url, body) without flagging body. That fix was right, but incomplete: it taught the rule to skip non-strings without teaching it to look inside them.

http_post(url="https://api.internal.com/v1",
          payload={"redirect": "http://evil.com"})    # -> executed

A redirect or callback field is as much an exfiltration route as the url parameter. And SensitiveDataFilter already recursed into containers, so the two shipped rules disagreed about how deep to look.

This was a regression I introduced in 0.3.2. For the record, comparing versions on the same input:

Case	0.3.1	0.3.3	0.3.4
legit multi-arg call	BLOCKED (wrongly)	ALLOWED	ALLOWED
evil URL in dict	BLOCKED (by accident)	ALLOWED	BLOCKED
evil URL in list	BLOCKED (by accident)	ALLOWED	BLOCKED
evil URL top-level	BLOCKED	BLOCKED	BLOCKED

0.3.1 blocked the nested case only because urlparse() raised on a dict and its bare except Exception returned Invalid URL — it was blocking everything non-string, which is why it also blocked legitimate calls. It looked secure because it was uniformly broken.

The change

URLAllowList now walks dict, list, tuple, set and frozenset, applying the existing URL check to every string it reaches. The per-URL logic is unchanged — it moved into _check_url untouched.

Two decisions worth flagging, both slightly beyond "recurse into containers":

• Dict keys are checked, not just values. An endpoint map can carry a URL as a key. This also means URLAllowList is not subject to the dict-key blind spot that SensitiveDataFilter still has (tracked in the local audit backlog).
• Sets and frozensets are walked too, not just the three container types named in the request. payload={"http://evil.com"} is the same gap, and leaving it out would have meant filing a follow-up issue immediately.

A seen-set of container ids guards against self-referential arguments, so a cyclic payload can't hang the check.

Verification

=== 0.3.2 behaviour preserved ===
legit URL + prose body       -> ALLOWED
legit URL + int timeout      -> ALLOWED
legit URL + benign dict      -> ALLOWED
legit URL + allowed nested   -> ALLOWED
UPPERCASE host               -> ALLOWED

=== the gap is closed ===
evil host top-level          -> BLOCKED  (URL domain not in allowlist: evil.com)
evil host in dict VALUE      -> BLOCKED  (URL domain not in allowlist: evil.com)
evil host in dict KEY        -> BLOCKED  (URL domain not in allowlist: evil.com)
evil host in nested list     -> BLOCKED  (URL domain not in allowlist: evil.com)
file:// in dict              -> BLOCKED  (URL scheme not allowed: file)

71 tests pass (was 60), rules.py at 97%. New tests cover the dict value/key cases, arbitrary nesting depth, a parametrized sweep over all five container types, cyclic containers, and — importantly — that an allowlisted URL inside a container is not turned into a violation, plus that a benign structured payload still passes. The existing multi-argument integration test was extended rather than replaced.

Note

README.md's Limitations section says "only str, list, tuple, and dict values are inspected". That remains accurate for SensitiveDataFilter but now understates URLAllowList, which also reaches sets and dict keys. Understating protection is the safe direction so I've left it, but it's worth a wording pass next time the README is touched.

[higagan]

Added two .gitignore commits to this branch. They were originally pushed to the #29 branch but landed after that PR merged, so they never reached main — cherry-picked here rather than opening a third PR for three lines.

hn_proof.py
scratch_*.py
*.local.md

Covers local scratch scripts and notes so they can't be swept into a commit. The sdist was already protected by the explicit allowlist added in 0.3.2, so this is about accidental git add, not about the published artifact.

Still 71 tests passing.