[Jaehyup (Jay) Shin (shin0343)]

Description

SSRFOutputScorer misses internal URL targets such as http://[::ffff:127.0.0.1]/, http://2130706433/, and http://user:pass@127.0.0.1/. It also flags public URLs such as http://10.0.0.1.example.com/ and URLs containing a metadata address only in user information or a path.

The built-in configuration now classifies the complete URL host, normalizes IPv6 and legacy numeric IPv4, and recognizes known IP-based nip.io/sslip.io names and localtest.me without DNS requests. Metadata coverage includes AWS IPv6 IMDS, AWS ECS, and Alibaba. For HTTP(S), both authority interpretations used by clients such as Requests and HTTPX are considered when a backslash is present. Other custom pattern mappings retain their literal regex behavior, and the existing named rationales, categories, and public scoring/persistence contracts are preserved.

Related to #3324, originally reported by Authensor (@AUTHENSOR). This PR addresses its SSRF portion only and leaves the umbrella issue open. It is a draft for scope review with the issue author and maintainers; I did not find an overlapping SSRF implementation PR. Matching remains a payload heuristic rather than proof that a request executed or that an arbitrary hostname resolves internally.

Tests and Documentation

• Full unit suite after merging upstream main at 2092dd7 (make unit-test): 32,202 passed, 23 skipped.
• Regex scorer suite: 1,256 passed, including public scoring, SQLite persistence, wrappers, network boundaries, custom mappings, and DNS isolation; the SSRF module has 100% statement/branch coverage.
• All applicable pre-commit hooks passed, including type checking.
• Independent review: 216 SSRF tests and 468 additional offline combinations passed. A Requests/HTTPX backslash-interpretation regression found during review was fixed and re-verified with 8 public scoring/persistence cases.
• A seeded differential check of 16,000 valid numeric IPv4 representations against socket.inet_aton found no mismatches and made no DNS requests.
• On a synthetic 53-case regression corpus: FN 23 → 0; FP 7 → 0. These are regression results, not an estimate of performance on general model outputs.
• Updated both doc/code/scoring/1_true_false_scorers.py and its paired notebook. Their 26 cells remain synchronized and existing notebook outputs are preserved. This documentation-only change was checked without executing live API examples.

AI assistance: implementation, tests, and this description were prepared with OpenAI Codex.

[Jaehyup (Jay) Shin (shin0343)]

@microsoft-github-policy-service agree

[Jaehyup (Jay) Shin (shin0343)]

@microsoft-github-policy-service agree

[Jaehyup (Jay) Shin (shin0343)]

The license/cla check now reports All CLA requirements met for head 44a77dc028ba9c38b6cc4fad34dbcc0bbb5f2ad2. The build/test, coverage, frontend, CodeQL, book, and Docker workflow runs are currently action_required before their jobs can run. Could a maintainer review and approve the external-contributor Actions runs?

This remains a draft for scope review: it covers only the SSRF portion of #3324 and leaves the umbrella issue open. The PR records 32,202 passing local unit tests, 1,256 passing regex scorer tests, and offline host-normalization checks without DNS requests. Feedback on whether this SSRF-only scope fits the intended direction would help move it forward.