security: fix SSRF in multimodal image URL loading (_load_image)

[hoangperry]

Summary

_load_image() calls urllib.request.urlopen(image_url) with no URL validation. When deployed as a server-side inference API, any user who sends chat completion requests with image_url content can cause the server to make HTTP requests to internal network addresses.

Vulnerable code (before)

with urllib.request.urlopen(image_url) as f:
    image_bytes = f.read()

urllib.request.urlopen follows HTTP redirects by default, so an attacker-controlled server returning a 302 to an internal address bypasses any future IP filtering.

Attack scenario

{"role": "user", "content": [{"type": "image_url", "image_url": {"url": "http://internal-service/"}}]}

The server fetches the internal URL.

Fix

• _validate_image_url(): resolves hostname to IP and blocks RFC 1918, loopback, and link-local ranges (169.254.x.x cloud metadata endpoints).
• Custom _ValidatingRedirectHandler: validates every redirect target before following, preventing redirect-chain bypass.

Test plan

• http://127.0.0.1/ blocked (loopback)
• http://169.254.169.254/ blocked (cloud metadata)
• http://10.0.0.1/ blocked (RFC 1918)
• Redirect to private IP blocked
• https://public-site.com/image.jpg still works