Summary

There are multiple SSRF and local-file-read surfaces exposed through request-driven inputs in server paths.

A) parse_image_url / parse_audio_url accept remote URLs and local files

mistralrs-server-core/src/util.rs:

• Accepts http/https, file, and data schemes.
• If URL parse fails but a local path exists, converts it to a file URL and reads it.
• Reads entire remote response body via reqwest::get(...).bytes().await?.to_vec().
• Reads entire local file into memory using metadata.len() + read_exact.

mistralrs-server-core/src/chat_completion.rs parses user-provided media URLs from request content and calls these helpers.

B) Web extraction tool fetches arbitrary URL

mistralrs-core/src/search/mod.rs:

• run_extract_tool uses reqwest::blocking::Client::new().get(&params.url).send() and returns extracted text content.
• No URL scheme/host/IP restrictions are visible in this path.

Why this is security-relevant

For untrusted remote callers, this enables:

• SSRF against internal services (including metadata or intranet addresses)
• Local file reads (file:// and path fallback) in server process context
• Potential data exfiltration path by injecting retrieved content into model/tool outputs
• Resource abuse risk from unbounded download/read behavior (large files/responses)

Code references

• mistralrs-server-core/src/util.rs lines around:
  • parse_image_url: URL/path parsing + reqwest::get + file read
  • parse_audio_url: URL/path parsing + reqwest::get + file read
• mistralrs-server-core/src/chat_completion.rs:
  • user media URLs passed to parse_image_url / parse_audio_url
• mistralrs-core/src/search/mod.rs:
  • run_extract_tool arbitrary URL fetch and return

Suggested hardening

1. Disable local file reads by default in HTTP server mode (opt-in flag such as --allow-local-files).
2. Restrict URL schemes by default (https/http only), with file:// disabled unless explicitly enabled.
3. Add SSRF protections:
   • block private/link-local/loopback ranges and common metadata endpoints,
   • enforce DNS/IP validation after resolution,
   • limit or disable redirects.
4. Add strict timeouts and max-byte limits for all network and file fetch paths.
5. Consider disabling extraction tool by default or restricting it via allowlist/policy.

Duplicate check

I searched existing issues for dedicated reports with terms like SSRF, parse_image_url, run_extract_tool, and website_content_extractor, and did not find a dedicated issue focused on this SSRF/local-file-read surface.