Security: Fix SSRF vulnerabilities in Python example scripts (Snyk findings)

[devin-ai-integration]

Summary

Make sure to read the contributing guidelines before submitting a PR

This PR addresses Server-Side Request Forgery (SSRF) vulnerabilities (CWE-918) identified by Snyk security scan in two Python example scripts. The vulnerabilities allowed unsanitized command-line input to flow directly into HTTP requests, potentially enabling attackers to manipulate host parameters for malicious purposes.

Changes

Added input validation to prevent SSRF attacks in:

• examples/pydantic_models_to_grammar_examples.py
• tools/tts/tts-outetts.py

Implementation Details

Created validate_host() function that:

• Validates host parameter format using urllib.parse
• Blocks invalid characters (null bytes, whitespace, @ symbols)
• Restricts to HTTP/HTTPS schemes only
• Provides clear error messages for invalid inputs

Security Context

Snyk Findings:

• Rule ID: python/Ssrf
• Severity: Medium
• CWE-918: Server-Side Request Forgery
• Affected: 3 vulnerable code paths across 2 files

Attack Vector: Malicious actors could manipulate command-line host parameters to access internal services, scan internal networks, or exfiltrate data from non-public endpoints.

Review Checklist

⚠️ Critical items to verify:

1. Validation strictness: Does the validation properly balance security with usability? These are example scripts meant to connect to local llama-server instances.
2. IPv6 support: Verify the validation correctly handles IPv6 addresses (e.g., [::1]:8080)
3. Edge cases: Test with various valid hostname formats including:
   • localhost:8080
   • 127.0.0.1:8080
   • my-server.local:8080
   • http://localhost:8080 (with explicit scheme)
4. Error handling consistency: Note the different error handling approaches between the two files (implicit vs explicit)
5. Code duplication: The validation function is duplicated in both files rather than being shared

Testing

• ✅ Python syntax validation passed for both files
• ⚠️ Not tested: Integration testing with actual llama-server instances
• ⚠️ Recommended: Manual testing with various host formats to ensure no legitimate use cases are broken

---

Link to Devin run: https://app.devin.ai/sessions/f6397deb8913436aabd4c1f234f8f8fd
Requested by: Jake Cosme (@jakexcosme)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring