ComputerUseToolset passed the url the model supplied straight to the
browser driver, without checking it. A model-invented url could point the
browser at a cloud metadata endpoint, a file:// path, or a private-network
host.
navigate now runs the same url checks load_web_page does before the url
reaches the driver. A url that fails returns an error to the model,
reporting the page the browser is still on, rather than opening it. Name
resolution runs off the event loop, so every navigation to a public host
now costs one DNS lookup.
Behaviour change: an agent driving a browser at localhost or another
internal host gets a refusal until it is constructed with the new
ComputerUseToolset(allow_private_network_access=True), which defaults to
False.
This reuses v1's existing load_web_page helpers, and the earlier commit in
this branch that unwraps embedded IPv4 addresses is a prerequisite for it.
With that commit in place the guard refuses the same addresses main's does,
including the NAT64 and IPv4-compatible encodings of an internal address.
George Weale
f56c3e520b