AIKIDO-2026-154296

TL;DR

The AWS Strands integration's _fetch_url_bytes helper fetches multimodal content URLs with urllib.request.urlopen and no scheme allowlist, no address validation, and no redirect re-validation. A RunAgentInput payload can use a loopback, private, link local, or metadata service address, or a file:// URL, and the response bytes stream back to the caller through the SSE output with no size bound. The fix adds a scheme policy that allows only http and https, rejects loopback, private, link local, reserved, and CGNAT destinations, re-validates redirects, blocks HTTPS to HTTP downgrades, and caps the read size.