From 9c3803828b91e5285da037ae697d1d5e643bda2c Mon Sep 17 00:00:00 2001
From: xbsheng <xxbsheng@gmail.com>
Date: Mon, 16 Mar 2026 10:41:02 +0800
Subject: [PATCH] fix: add SSRF check in WebSearchTool to prevent unsafe URL
 access

---
 src/openjarvis/tools/web_search.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/openjarvis/tools/web_search.py b/src/openjarvis/tools/web_search.py
index 0b01f8cc..430e58b3 100644
--- a/src/openjarvis/tools/web_search.py
+++ b/src/openjarvis/tools/web_search.py
@@ -8,6 +8,7 @@ from typing import Any
 from openjarvis.core.registry import ToolRegistry
 from openjarvis.core.types import ToolResult
 from openjarvis.tools._stubs import BaseTool, ToolSpec
+from openjarvis.security.ssrf import check_ssrf
 
 
 @ToolRegistry.register("web_search")
@@ -76,6 +77,9 @@ class WebSearchTool(BaseTool):
         import httpx
 
         url = WebSearchTool._normalize_url(url)
+        ssrf_error = check_ssrf(url)
+        if ssrf_error:
+            raise ValueError(ssrf_error)
         resp = httpx.get(
             url.strip(),
             follow_redirects=True,