fix(local-http): reject nested encoded traversal in local request targets

[seonghobae]

Superseded by verified canonical successor #1635 — 2026-09-10

Generated head 10166f4fe93e6d89a47713ccdc1b594bc1777cb9 identified a real helper-level nested-decoding gap but was direct-based on stale protected develop, carried no retained regression, and added .jules/sentinel.md wording that overstated a verified production exploit. Follow-up a9a9177f844f0ce1d7e7590061e6e3e59da92bdc added the missing focused tests and narrowed the PR authority, but the branch still inherited the known frontend dependency-security RED from protected develop.

Canonical successor #1635 is based exactly on frontend-security owner #1623@17a7618eda2b212b691f08fa936e042b34258fc9 and carries every valid delta from this proposal plus its required regression, while intentionally dropping the unsupported generated security-history claim:

• RED 763854fe229ca89e39497d00dea6e2b4848ee310: focused nested traversal/backslash/control and excessive-depth regressions on unchanged fix(deps): patch frontend audit security floors #1623 source.
• GREEN candidate ff7f85a54f2027fc7d35748c916aa066e8072739: bounded recursive decoding in backend/core/local_http.py plus those tests.
• Effective successor delta: exactly backend/core/local_http.py and backend/tests/test_local_http.py.

No unique valid product delta, fixture, contract or evidence remains solely on this PR. The .jules/sentinel.md addition is specifically rejected as authority because the live call graph establishes a local smoke/live-test helper, not a demonstrated attacker-controlled second decode or production SSRF chain. Historical queued/failed checks on this direct-base branch are not transferred to #1635.

This Close is therefore a complete-successor reconciliation, not abandonment of the finding. Continue all validation, review and eventual integration on Draft #1635. No force-push, destructive rebase, gate weakening, or unsupported CRITICAL claim.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@codex review

Review only exact head a9a9177f844f0ce1d7e7590061e6e3e59da92bdc. Please verify the local-only call graph before assigning severity, the bounded recursive decoding semantics, nested traversal/backslash/control-character rejection, excessive-depth fail-closed behavior, and whether the new backend/tests/test_local_http.py cases fully cover the causal boundary. Do not treat the generated .jules/sentinel.md CRITICAL wording as authority.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[google-labs-jules]

@codex review

Review only exact head a9a9177f844f0ce1d7e7590061e6e3e59da92bdc. Please verify the local-only call graph before assigning severity, the bounded recursive decoding semantics, nested traversal/backslash/control-character rejection, excessive-depth fail-closed behavior, and whether the new backend/tests/test_local_http.py cases fully cover the causal boundary. Do not treat the generated .jules/sentinel.md CRITICAL wording as authority.

Acknowledged. Ignoring this command as it is for the @codex bot.

[chatgpt-codex-connector]

To use Codex here, create a Codex account and connect to github.