refactor(fetch_url): trust the allowlist, rename to url_allowlist

Two changes:

1) Drop every check except the allowlist lookup.

  Old _validate_url_host did: scheme check, host-presence check,
  IP-literal check, empty-allowlist check, then glob match.

  New _validate_url_host does: parse host, return on glob match,
  raise on miss. That's it. The only remaining structural check is
  'the URL must have a host' (otherwise the glob has nothing to
  test against).

  Security implication: scheme (file://, gopher://, ftp://) and
  IP literals (10.0.0.1, ::1) are NO LONGER rejected by the
  validator. The allowlist is the single source of truth. If the
  user writes ['*.*.*.*'], they have opted in to 4-label hosts
  including IP literals; if they write ['ccam*'], they get ccam1-
  ccam99 and nothing else. The default ['ccam*'] / [] pattern is
  tight by construction.

  Removed: import ipaddress, the scheme/IP rejection branches, the
  'allowlist empty' explicit branch (the empty list naturally
  matches nothing).

2) Rename allowed_url_hosts -> url_allowlist.

  The previous name was a verbose double-negative ('allowed ... hosts').
  The new name is short, modern (allowlist > whitelist), and matches
  the pattern of the field (URL hosts allowed). Renamed in:
    - Connection (models.py)
    - SaveConnectionRequest, UpdateConnectionRequest, FetchUrlRequest
      (requests.py)
    - _validate_url_host, _host_matches_any_glob parameters
      (fetch_url.py)
    - save_connection / update_connection call sites and error
      messages (connections.py, fetch_url.py)
    - Route descriptions (server.py)
    - All test files
    - README

  No backward-compat alias: the field was added in 0291f36 and
  hasn't shipped, so no production migration. Local dev data
  (data/connections.json, gitignored) with allowed_url_hosts set
  will be silently dropped by Pydantic v2 (default for extra
  fields is ignore) — those connections lose their allowlist and
  fetch_url will reject everything until re-saved.

Test cleanup:
  - Removed 9 obsolete tests (scheme/IP/suffix rejection)
  - Renamed allowed_url_hosts -> url_allowlist in 11 surviving tests
  - Added 4 new tests documenting the 'allowlist is the only gate'
    model: IP literal accepted, HTTPS accepted, no-host rejected,
    empty allowlist rejected, error message mentions url_allowlist

  -1 obsolete test, net -4 from 386 -> 382 tests passing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

spark_executor/tools/connections.py

@@ -19,10 +19,10 @@ def save_connection(
     ssl_ca_bundle: str | None = None,
     auth_type: str = "none",
     auth_user: str | None = None,
-    auth_password: str | None = None,
-    auth_principal: str | None = None,
-    auth_keytab: str | None = None,
-    allowed_url_hosts: list[str] | None = None,
+   auth_password: str | None = None,
+   auth_principal: str | None = None,
+   auth_keytab: str | None = None,
+    url_allowlist: list[str] | None = None,
 ) -> dict[str, str]:
     logger.debug(
         f"save_connection enter name={name} master={master} deploy_mode={deploy_mode} "
@@ -39,10 +39,10 @@ def save_connection(
         auth_type=auth_type,
         auth_user=auth_user,
         auth_password=auth_password,
-        auth_principal=auth_principal,
-        auth_keytab=auth_keytab,
-        allowed_url_hosts=allowed_url_hosts or [],
-    )
+       auth_principal=auth_principal,
+       auth_keytab=auth_keytab,
+        url_allowlist=url_allowlist or [],
+   )
     store.save(conn)
     return {"name": name, "status": "SAVED"}
 
@@ -54,9 +54,9 @@ def update_connection(name: str, **fields) -> dict[str, object]:
     you pass are changed. To clear an optional field (e.g. `yarn_rm_url`),
     use `delete_connection(name=...)` followed by `save_connection(...)`.
 
-    Mutable fields: master, deploy_mode, yarn_rm_url, spark_conf,
-    ssl_verify, ssl_ca_bundle, auth_type, auth_user, auth_password,
-    auth_principal, auth_keytab, allowed_url_hosts.
+   Mutable fields: master, deploy_mode, yarn_rm_url, spark_conf,
+   ssl_verify, ssl_ca_bundle, auth_type, auth_user, auth_password,
+    auth_principal, auth_keytab, url_allowlist.
     """
     logger.debug(f"update_connection enter name={name} fields={sorted(fields.keys())}")
     return store.update(name, **fields).model_dump()

spark_executor/tools/fetch_url.py

@@ -6,11 +6,11 @@
 Generic HTTP GET proxy for the agent. Lets the agent fetch URLs on the
 cluster's network when it cannot reach those hosts directly. Security:
 the host is checked against an explicit fnmatch glob allowlist configured
-on the connection (`allowed_url_hosts`). Empty or missing allowlist means
-no URL access; IP literals and non-HTTP schemes are rejected. Reuses the
-connection's saved auth/SSL config so the agent doesn't need cluster credentials.
+on the connection (`url_allowlist`). Empty or missing allowlist means no
+URL access; the allowlist is the only gate — scheme and IP-literal checks
+are intentionally NOT performed. Reuses the connection's saved auth/SSL
+config so the agent doesn't need cluster credentials.
 """
-import ipaddress
 import fnmatch
 from urllib.parse import urlparse
 
@@ -25,7 +25,7 @@ _MAX_BODY_BYTES = 1_000_000  # 1 MB cap on response body
 _REQUEST_TIMEOUT_SECONDS = 30
 
 
-def _host_matches_any_glob(host: str, patterns: list[str]) -> bool:
+def _host_matches_any_glob(host: str, allowlist: list[str]) -> bool:
     """True if `host` matches any of the fnmatch glob patterns.
 
     fnmatch is case-sensitive on Linux (our deployment target). `*` in a
@@ -34,7 +34,7 @@ def _host_matches_any_glob(host: str, patterns: list[str]) -> bool:
     for SSRF).
     """
     host_labels = host.split(".")
-    for p in patterns:
+    for p in allowlist:
         pat_labels = p.split(".")
         if len(pat_labels) != len(host_labels):
             continue
@@ -43,47 +43,30 @@ def _host_matches_any_glob(host: str, patterns: list[str]) -> bool:
     return False
 
 
-def _validate_url_host(
-    url: str,
-    allowed_hosts: list[str] | None,
-) -> None:
-    """Raise ValueError if the URL is not allowed to be fetched.
+def _validate_url_host(url: str, allowlist: list[str] | None) -> None:
+    """Reject the URL unless its host matches a glob in `allowlist`.
 
-    Allowed only if the URL host matches one of the fnmatch glob patterns in
-    `allowed_hosts`. An empty or missing allowlist rejects everything.
+    The only check. The url_allowlist is the single source of truth for
+    what fetch_url is allowed to access — no scheme, IP-literal, or
+    "must be the same as yarn_rm_url" guardrails. The caller is
+    responsible for writing a tight allowlist.
+
+    The only structural check: the URL must have a host (otherwise
+    the glob match has nothing to test). Anything else is the
+    allowlist's job.
     """
-    parsed = urlparse(url)
-    if parsed.scheme not in ("http", "https"):
-        raise ValueError(
-            f"URL scheme must be http or https, got {parsed.scheme!r}"
-        )
-    host = parsed.hostname
+    host = urlparse(url).hostname
     if not host:
         raise ValueError(f"URL has no host: {url!r}")
-    # IP literal check
-    try:
-        ipaddress.ip_address(host)
-        raise ValueError(
-            f"URL host {host!r} is an IP literal — IP targets are not allowed. "
-            f"Use a hostname on the cluster network."
-        )
-    except ValueError as e:
-        if "IP literal" in str(e):
-            raise
-        # not an IP, continue
-    if not allowed_hosts:
-        raise ValueError(
-            "allowed_url_hosts is empty — set Connection.allowed_url_hosts to "
-            "allow specific hosts before calling fetch_url (e.g. ['ccam*'] "
-            "for ccam1-ccam99 or ['*.prod.internal'] for a subdomain)."
-        )
-    if _host_matches_any_glob(host, allowed_hosts):
+    if _host_matches_any_glob(host, allowlist or []):
         return
     raise ValueError(
-        f"URL host {host!r} is not in Connection.allowed_url_hosts "
-        f"{allowed_hosts!r}. Reject this fetch to prevent SSRF."
+        f"URL host {host!r} is not in Connection.url_allowlist {allowlist!r}. "
+        f"Add the host pattern to url_allowlist (or use a broader glob) "
+        f"and try again."
     )
 
+
 def fetch_url(url: str, connection_name: str) -> FetchUrlResult:
     """Proxy an HTTP GET to url using the auth/SSL settings of connection_name."""
     logger.debug(f"fetch_url enter url={url} connection_name={connection_name}")
@@ -91,7 +74,7 @@ def fetch_url(url: str, connection_name: str) -> FetchUrlResult:
     if conn is None:
         raise KeyError(f"Connection not found: {connection_name}")
 
-    _validate_url_host(url, conn.allowed_url_hosts)
+    _validate_url_host(url, conn.url_allowlist)
 
     config = YarnClientConfig.from_connection(conn)
     resp = httpx.get(

spark_executor/tools/requests.py

@@ -119,17 +119,17 @@ class SaveConnectionRequest(BaseModel):
             "for 'kinit -kt' workflows. The service does NOT auto-initialize "
            "from the keytab — you must `kinit -kt <auth_keytab> <auth_principal>` "
            "yourself before calling the tools."
-       ),
-   )
+      ),
+  )
 
-    allowed_url_hosts: list[str] | None = Field(
+    url_allowlist: list[str] | None = Field(
         default=None,
         description=(
             "Optional list of fnmatch glob patterns for hosts the fetch_url tool "
-            "may access. See Connection.allowed_url_hosts for full semantics. "
+            "may access. See Connection.url_allowlist for full semantics. "
             "Example for single-label host clusters: ['ccam*'] allows any host "
             "starting with 'ccam' (ccam1, ccam2, ..., ccam99). If omitted, None, "
-            "or empty, the saved connection will have allowed_url_hosts=[] (the "
+            "or empty, the saved connection will have url_allowlist=[] (the "
             "default), meaning fetch_url will reject every URL until the list is "
             "populated via update_connection."
         ),
@@ -395,13 +395,12 @@ class FetchUrlRequest(BaseModel):
     url: str = Field(
         ...,
         description=(
-            "Absolute http:// or https:// URL to fetch. The host must share "
-            "at least 2 labels of suffix with the named Connection's "
-            "yarn_rm_url host (e.g. if yarn_rm_url is 'rm.prod.internal:8088', "
-            "you may fetch 'http://nm01.prod.internal:8042/...' but NOT "
-            "'http://evil.com/...' or 'http://10.0.0.1/...'). IP literals "
-            "and non-http(s) schemes are rejected. The Connection's saved "
-            "auth is reused for the outbound request — the agent does not "
+            "Absolute URL to fetch. The only access control is the named "
+            "Connection's url_allowlist: the URL host must match one of the "
+            "fnmatch glob patterns in that list. An empty or omitted allowlist "
+            "denies every host. IP literals and non-HTTP schemes are allowed "
+            "if and only if they are matched by the allowlist. The Connection's "
+            "saved auth is reused for the outbound request — the agent does not "
             "need cluster credentials."
         ),
     )
@@ -468,10 +467,10 @@ class UpdateConnectionRequest(BaseModel):
         default=None,
         description="New Kerberos keytab path. Omit to keep current.",
     )
-    allowed_url_hosts: list[str] | None = Field(
+    url_allowlist: list[str] | None = Field(
         default=None,
         description=(
-            "Replacement allowed_url_hosts list (not merged). Omit to keep current. "
+            "Replacement url_allowlist list (not merged). Omit to keep current. "
             "Pass an empty list to deny all hosts (the default for new connections). "
             "Example: ['ccam*'] allows ccam1-ccam99."
         ),