Fix(client): Disable automatic HTTP redirects in SandboxConnector to prevent SSRF

[chw120]

What this PR does / why we need it:

This PR disables automatic HTTP redirects in the agentic-sandbox-client Python SDK to prevent a High-severity Server-Side Request Forgery (SSRF) vulnerability.

Currently, the SDK's SandboxConnector and AsyncSandboxConnector use default HTTP client settings that automatically follow 3xx redirects. Since the sandbox environment is inherently untrusted, an attacker with execution capabilities can force the orchestrator to perform unauthorized GET requests against internal infrastructure—such as cloud IMDS metadata (e.g., 169.254.169.254) or private internal APIs—by issuing a malicious redirect.

This fix explicitly sets allow_redirects=False (for requests) and follow_redirects=False (for httpx) to ensure the security boundary between the untrusted sandbox and the orchestrator's network is strictly enforced.

Release Note

SECURITY: Disables automatic HTTP redirects in the Python SDK's SandboxConnector to mitigate potential Server-Side Request Forgery (SSRF) attacks from compromised sandboxes.

[netlify]

✅ Deploy Preview for agent-sandbox ready!

Name	Link
🔨 Latest commit	f2ee079
🔍 Latest deploy log	https://app.netlify.com/projects/agent-sandbox/deploys/6a17541a4ba0940008707be5
😎 Deploy Preview	https://deploy-preview-816--agent-sandbox.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Pull request overview

This PR hardens the Python SDK’s SandboxConnector / AsyncSandboxConnector against SSRF by disabling automatic following of HTTP redirects when communicating with an untrusted sandbox.

Changes:

• Force requests calls to use allow_redirects=False in the sync connector.
• Force httpx calls to use follow_redirects=False in the async connector.
• Add unit tests asserting redirects are disabled for both connectors.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
clients/python/agentic-sandbox-client/k8s_agent_sandbox/connector.py	Disables automatic redirect following for sync HTTP requests.
clients/python/agentic-sandbox-client/k8s_agent_sandbox/async_connector.py	Disables automatic redirect following for async HTTP requests.
clients/python/agentic-sandbox-client/k8s_agent_sandbox/test/unit/test_connector.py	Adds a unit test asserting allow_redirects=False is passed.
clients/python/agentic-sandbox-client/k8s_agent_sandbox/test/unit/test_async_sandboxclient.py	Adds a unit test asserting follow_redirects=False is passed.

[chw120]

/priority critical-urgent

[barney-s]

Couple of small observations/recommendations to consider for completeness:

1. Clarifying Comment on pop("allow_redirects") / pop("follow_redirects"):
   Currently, the comments explain that this prevents TypeError due to duplicate keyword arguments. It is worth briefly expanding the comment (or log message) to explicitly note that the SDK mandates blocking redirects for SSRF mitigation, and user-provided redirect settings are overridden/ignored for security reasons.

2. Handling other 3xx Status Codes (e.g., 300 / 305 / 306):
   Neither requests nor httpx considers status codes like 300 Multiple Choices, 305 Use Proxy, or 306 Switch Proxy as response.is_redirect = True by default.

   • Since allow_redirects=False/follow_redirects=False is set at the client request level, the client will not automatically follow redirects for these status codes. So there is no SSRF risk.
   • However, since these codes do not trigger response.is_redirect = True, they will bypass the redirection error raise and instead execute response.raise_for_status(). Since raise_for_status only raises for 400 <= status_code < 600, these 3xx responses will be returned directly to the caller. This is acceptable behavior, but is worth noting.

[chw120]

Couple of small observations/recommendations to consider for completeness:

1. Clarifying Comment on pop("allow_redirects") / pop("follow_redirects"):
   Currently, the comments explain that this prevents TypeError due to duplicate keyword arguments. It is worth briefly expanding the comment (or log message) to explicitly note that the SDK mandates blocking redirects for SSRF mitigation, and user-provided redirect settings are overridden/ignored for security reasons.

2. Handling other 3xx Status Codes (e.g., 300 / 305 / 306):
   Neither requests nor httpx considers status codes like 300 Multiple Choices, 305 Use Proxy, or 306 Switch Proxy as response.is_redirect = True by default.

   • Since allow_redirects=False/follow_redirects=False is set at the client request level, the client will not automatically follow redirects for these status codes. So there is no SSRF risk.
   • However, since these codes do not trigger response.is_redirect = True, they will bypass the redirection error raise and instead execute response.raise_for_status(). Since raise_for_status only raises for 400 <= status_code < 600, these 3xx responses will be returned directly to the caller. This is acceptable behavior, but is worth noting.

Thanks @barney-s for review. Updated the comments to cover them.

[barney-s]

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aditya-shantanu, barney-s, chw120

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• clients/python/agentic-sandbox-client/OWNERS [barney-s]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment