fix(tools): pin SSRF checks to each redirect hop and peer IP

validate_url only inspected the original URL string, so scraping fetches
could follow a 302 to an internal address or rebind DNS between check and
connect. Route safe_get through an HTTPAdapter that re-validates every hop
and connects to the authorised sockaddr, and let FORCE_SAFE_PATHS ignore a
tenant-supplied escape hatch on managed workers.

Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>

Author: cursoragent

docs/edge/ar/tools/web-scraping/scrapeelementfromwebsitetool.mdx

@@ -9,7 +9,7 @@ mode: "wide"
 
 ## الوصف
 
-أداة `ScrapeElementFromWebsiteTool` مصممة لاستخراج عناصر محددة من المواقع باستخدام محددات CSS. تسمح هذه الأداة لوكلاء CrewAI باستخراج محتوى مستهدف من صفحات الويب، مما يجعلها مفيدة لمهام استخراج البيانات حيث تكون أجزاء محددة فقط من صفحة الويب مطلوبة.
+أداة `ScrapeElementFromWebsiteTool` مصممة لاستخراج عناصر محددة من المواقع باستخدام محددات CSS. تسمح هذه الأداة لوكلاء CrewAI باستخراج محتوى مستهدف من صفحات الويب، مما يجعلها مفيدة لمهام استخراج البيانات حيث تكون أجزاء محددة فقط من صفحة الويب مطلوبة. تمر الطلبات عبر مساعد HTTP الآمن ضد SSRF في CrewAI: يتم فحص عنوان URL المطلوب وكل قفزة إعادة توجيه مقابل النطاقات الخاصة والمحجوزة (بما في ذلك بيانات تعريف السحابة)، ويُثبَّت اتصال TCP على عنوان IP الذي اجتاز هذا الفحص.
 
 ## التثبيت
 

docs/edge/ar/tools/web-scraping/scrapewebsitetool.mdx

@@ -16,6 +16,8 @@ mode: "wide"
 أداة مصممة لاستخراج وقراءة محتوى موقع محدد. قادرة على التعامل مع أنواع مختلفة من صفحات الويب عن طريق إجراء طلبات HTTP وتحليل محتوى HTML المستلم.
 يمكن أن تكون هذه الأداة مفيدة بشكل خاص لمهام استخراج البيانات من الويب وجمع البيانات أو استخراج معلومات محددة من المواقع.
 
+تمر الطلبات عبر مساعد HTTP الآمن ضد SSRF في CrewAI: يتم فحص عنوان URL المطلوب وكل قفزة إعادة توجيه مقابل النطاقات الخاصة والمحجوزة (بما في ذلك بيانات تعريف السحابة)، ويُثبَّت اتصال TCP على عنوان IP الذي اجتاز هذا الفحص.
+
 ## التثبيت
 
 ثبّت حزمة crewai_tools

docs/edge/en/tools/file-document/filereadtool.mdx

@@ -77,4 +77,4 @@ To let an agent read a directory tree outside the working directory, point `base
 file_read_tool = FileReadTool(base_dir='/data')
 ```
 
-As a last resort, setting `CREWAI_TOOLS_ALLOW_UNSAFE_PATHS=true` disables path validation. This applies process-wide to every crewai-tools tool, including the SSRF protections on URL-fetching tools, so prefer `base_dir`.
+As a last resort, setting `CREWAI_TOOLS_ALLOW_UNSAFE_PATHS=true` disables path validation. This applies process-wide to every crewai-tools tool, including the SSRF protections on URL-fetching tools, so prefer `base_dir`. Managed workers should set `CREWAI_TOOLS_FORCE_SAFE_PATHS=true` so a tenant cannot disable those checks by exporting the escape hatch.

docs/edge/en/tools/web-scraping/scrapeelementfromwebsitetool.mdx

@@ -9,7 +9,7 @@ mode: "wide"
 
 ## Description
 
-The `ScrapeElementFromWebsiteTool` is designed to extract specific elements from websites using CSS selectors. This tool allows CrewAI agents to scrape targeted content from web pages, making it useful for data extraction tasks where only specific parts of a webpage are needed.
+The `ScrapeElementFromWebsiteTool` is designed to extract specific elements from websites using CSS selectors. This tool allows CrewAI agents to scrape targeted content from web pages, making it useful for data extraction tasks where only specific parts of a webpage are needed. Fetches go through CrewAI's SSRF-safe HTTP helper: the requested URL and every redirect hop are checked against private and reserved ranges (including cloud metadata), and the TCP connection is pinned to an IP that passed that check.
 
 ## Installation
 

docs/edge/en/tools/web-scraping/scrapewebsitetool.mdx

@@ -16,6 +16,8 @@ mode: "wide"
 A tool designed to extract and read the content of a specified website. It is capable of handling various types of web pages by making HTTP requests and parsing the received HTML content. 
 This tool can be particularly useful for web scraping tasks, data collection, or extracting specific information from websites.
 
+Fetches go through CrewAI's SSRF-safe HTTP helper: the requested URL and every redirect hop are checked against private and reserved ranges (including cloud metadata), and the TCP connection is pinned to an IP that passed that check.
+
 ## Installation
 
 Install the crewai_tools package

docs/edge/ko/tools/web-scraping/scrapeelementfromwebsitetool.mdx

@@ -9,7 +9,7 @@ mode: "wide"
 
 ## 설명
 
-`ScrapeElementFromWebsiteTool`은 CSS 선택자를 사용하여 웹사이트에서 특정 요소를 추출하도록 설계되었습니다. 이 도구는 CrewAI 에이전트가 웹 페이지에서 타겟이 되는 콘텐츠를 스크래핑할 수 있게 하여, 웹페이지의 특정 부분만이 필요한 데이터 추출 작업에 유용합니다.
+`ScrapeElementFromWebsiteTool`은 CSS 선택자를 사용하여 웹사이트에서 특정 요소를 추출하도록 설계되었습니다. 이 도구는 CrewAI 에이전트가 웹 페이지에서 타겟이 되는 콘텐츠를 스크래핑할 수 있게 하여, 웹페이지의 특정 부분만이 필요한 데이터 추출 작업에 유용합니다. 가져오기는 CrewAI의 SSRF 안전 HTTP 헬퍼를 거칩니다. 요청된 URL과 모든 리다이렉트 홉이 사설 및 예약 대역(클라우드 메타데이터 포함)에 대해 검사되며, TCP 연결은 그 검사를 통과한 IP에 고정됩니다.
 
 ## 설치
 

docs/edge/ko/tools/web-scraping/scrapewebsitetool.mdx

@@ -16,6 +16,8 @@ mode: "wide"
 지정된 웹사이트의 내용을 추출하고 읽을 수 있도록 설계된 도구입니다. 이 도구는 HTTP 요청을 보내고 수신된 HTML 콘텐츠를 파싱함으로써 다양한 유형의 웹 페이지를 처리할 수 있습니다.
 이 도구는 웹 스크래핑 작업, 데이터 수집 또는 웹사이트에서 특정 정보를 추출하는 데 특히 유용할 수 있습니다.
 
+가져오기는 CrewAI의 SSRF 안전 HTTP 헬퍼를 거칩니다. 요청된 URL과 모든 리다이렉트 홉이 사설 및 예약 대역(클라우드 메타데이터 포함)에 대해 검사되며, TCP 연결은 그 검사를 통과한 IP에 고정됩니다.
+
 ## 설치
 
 crewai_tools 패키지를 설치하세요

docs/edge/pt-BR/tools/web-scraping/scrapeelementfromwebsitetool.mdx

@@ -9,7 +9,7 @@ mode: "wide"
 
 ## Descrição
 
-A `ScrapeElementFromWebsiteTool` foi projetada para extrair elementos específicos de websites utilizando seletores CSS. Esta ferramenta permite que agentes CrewAI capturem conteúdos direcionados de páginas web, tornando-se útil para tarefas de extração de dados em que apenas partes específicas de uma página são necessárias.
+A `ScrapeElementFromWebsiteTool` foi projetada para extrair elementos específicos de websites utilizando seletores CSS. Esta ferramenta permite que agentes CrewAI capturem conteúdos direcionados de páginas web, tornando-se útil para tarefas de extração de dados em que apenas partes específicas de uma página são necessárias. As buscas passam pelo helper HTTP seguro contra SSRF do CrewAI: a URL solicitada e cada hop de redirecionamento são verificados contra faixas privadas e reservadas (incluindo metadados de nuvem), e a conexão TCP é fixada no IP que passou nessa verificação.
 
 ## Instalação
 

docs/edge/pt-BR/tools/web-scraping/scrapewebsitetool.mdx

@@ -16,6 +16,8 @@ mode: "wide"
 Uma ferramenta desenvolvida para extrair e ler o conteúdo de um site especificado. Ela é capaz de lidar com diversos tipos de páginas web fazendo requisições HTTP e analisando o conteúdo HTML recebido.
 Esta ferramenta pode ser especialmente útil para tarefas de raspagem de dados, coleta de dados ou extração de informações específicas de sites.
 
+As buscas passam pelo helper HTTP seguro contra SSRF do CrewAI: a URL solicitada e cada hop de redirecionamento são verificados contra faixas privadas e reservadas (incluindo metadados de nuvem), e a conexão TCP é fixada no IP que passou nessa verificação.
+
 ## Instalação
 
 Instale o pacote crewai_tools

lib/crewai-tools/src/crewai_tools/security/safe_path.py

@@ -5,7 +5,9 @@
 user-controlled or LLM-controlled inputs at runtime.
 
 Set CREWAI_TOOLS_ALLOW_UNSAFE_PATHS=true to bypass validation (not
-recommended for production).
+recommended for production). Managed workers should set
+CREWAI_TOOLS_FORCE_SAFE_PATHS=true so a tenant cannot disable these
+checks by exporting the escape hatch on their own deployment.
 """
 
 from __future__ import annotations
@@ -20,6 +22,7 @@
 logger = logging.getLogger(__name__)
 
 _UNSAFE_PATHS_ENV = "CREWAI_TOOLS_ALLOW_UNSAFE_PATHS"
+_FORCE_SAFE_PATHS_ENV = "CREWAI_TOOLS_FORCE_SAFE_PATHS"
 _BYPASS_HINT = f"Set {_UNSAFE_PATHS_ENV}=true to bypass this check."
 
 
@@ -69,9 +72,26 @@ def format_sandbox_error(error: Exception, remedy: str) -> str:
     return f"{text} {remedy}".strip()
 
 
+def _env_flag_enabled(name: str) -> bool:
+    return os.environ.get(name, "").lower() in ("true", "1", "yes")
+
+
 def _is_escape_hatch_enabled() -> bool:
-    """Check if the unsafe paths escape hatch is enabled."""
-    return os.environ.get(_UNSAFE_PATHS_ENV, "").lower() in ("true", "1", "yes")
+    """Check if the unsafe paths escape hatch is enabled.
+
+    ``CREWAI_TOOLS_FORCE_SAFE_PATHS`` wins: managed workers set it so a
+    tenant-supplied ``CREWAI_TOOLS_ALLOW_UNSAFE_PATHS`` cannot clear the
+    SSRF / path allow-list.
+    """
+    if _env_flag_enabled(_FORCE_SAFE_PATHS_ENV):
+        if _env_flag_enabled(_UNSAFE_PATHS_ENV):
+            logger.warning(
+                "%s is set; ignoring %s",
+                _FORCE_SAFE_PATHS_ENV,
+                _UNSAFE_PATHS_ENV,
+            )
+        return False
+    return _env_flag_enabled(_UNSAFE_PATHS_ENV)
 
 
 def validate_file_path(path: str, base_dir: str | None = None) -> str:
@@ -161,8 +181,8 @@ def validate_directory_path(path: str, base_dir: str | None = None) -> str:
 ]
 
 
-def _is_private_or_reserved(ip_str: str) -> bool:
-    """Check if an IP address is private, reserved, or otherwise unsafe."""
+def is_blocked_ip(ip_str: str) -> bool:
+    """Return True if *ip_str* is private, reserved, or otherwise unsafe to fetch."""
     try:
         addr = ipaddress.ip_address(ip_str)
         # Unwrap IPv4-mapped IPv6 addresses (e.g., ::ffff:127.0.0.1) to IPv4
@@ -187,6 +207,13 @@ def validate_url(url: str) -> str:
     DNS and checks that the target IP is not private or reserved (prevents
     SSRF to internal services and cloud metadata endpoints).
 
+    This checks the URL string it is handed. Callers that then fetch must
+    use :func:`crewai_tools.security.safe_requests.safe_get` (or a session
+    from :func:`crewai_tools.security.safe_requests.create_safe_session`)
+    so redirect hops are re-validated and the connection is pinned to an
+    authorised IP. Calling ``requests.get`` after this function re-resolves
+    DNS and follows redirects without these checks.
+
     Args:
         url: The URL to validate.
 
@@ -232,7 +259,7 @@ def validate_url(url: str) -> str:
 
     for _family, _, _, _, sockaddr in addrinfos:
         ip_str = str(sockaddr[0])
-        if _is_private_or_reserved(ip_str):
+        if is_blocked_ip(ip_str):
             raise ValueError(
                 f"URL '{url}' resolves to private/reserved IP {ip_str}. "
                 f"Access to internal networks is not allowed. "