Fix security vuls

[oyilmaz-nvidia]

No description provided.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[oyilmaz-nvidia]

/ok to test 4069c58

[oyilmaz-nvidia]

/ok to test 93cb8ce

[oyilmaz-nvidia]

/ok to test 0dd42e9

[chtruong814]

This does not fully close the SSRF yet. validate_image_url() checks one IPv4 resolution before the fetch, but both downstream requests.get() calls re-resolve the hostname and follow redirects. A public URL that redirects to 169.254.169.254/loopback, or DNS rebinding/mixed DNS answers, can therefore bypass the check. Please make validation part of the fetch: resolve and reject all A/AAAA non-global addresses, pin the connection to the validated destination, and either disable redirects or revalidate every hop. Please add redirect, rebinding/multiple-answer, and IPv6 tests. The file:// oracle is addressed.

[oyilmaz-nvidia]

/ok to test 1e1113a

[oyilmaz-nvidia]

/ok to test 1e1113a

[copy-pr-bot]

/ok to test 1e1113a

@oyilmaz-nvidia, there was an error processing your request: E2

See the following link for more information: https://docs.gha-runners.nvidia.com/cpr/e/2/