Package org.a2aproject.sdk.server.tasks

Class DefaultPushNotificationUrlValidator

java.lang.Object

org.a2aproject.sdk.server.tasks.DefaultPushNotificationUrlValidator

All Implemented Interfaces:

PushNotificationUrlValidator

@ApplicationScoped
public class DefaultPushNotificationUrlValidator
extends Object
implements PushNotificationUrlValidator

Default SSRF-safe implementation of PushNotificationUrlValidator.

Enforces the following policies (configurable via A2AConfigProvider):

• Scheme restriction — only https by default ("a2a.push-notification.url.allowed-schemes", comma-separated)
• Private-network blocking — loopback, link-local, site-local, cloud metadata (169.254.x.x), RFC 6598 shared space (100.64.0.0/10), IPv6 unique-local (fc00::/7), and IPv4-mapped IPv6 variants are all rejected unless "a2a.push-notification.url.allow-private-network-targets" is true
• DNS resolution caching — resolved addresses are cached for a configurable duration ("a2a.push-notification.url.dns-cache-ttl-seconds", default 30 s) to avoid blocking DNS lookups on every validation call. Set to 0 to disable caching.

Known limitation — DNS rebinding: hostname resolution happens at validation time (when the push notification is about to be sent), not at connection time. An attacker controlling a domain could register a URL that resolves to a public IP (passes validation), then change the DNS record to point to an internal address before the HTTP client opens the connection. The DNS cache mitigates the window somewhat by reusing the validated resolution, but does not eliminate the TOCTOU gap entirely. Deployments with strict SSRF requirements should use a network-level firewall to block outbound traffic to internal ranges.

Field Summary

Fields inherited from interface org.a2aproject.sdk.server.tasks.PushNotificationUrlValidator

ALLOW_ALL

Constructor Summary

Constructors

Constructor	Description
DefaultPushNotificationUrlValidator()

Method Summary

Modifier and Type	Method	Description
void	validate(String url)	Validates that the given URL is safe to use as a push notification target.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

DefaultPushNotificationUrlValidator

public DefaultPushNotificationUrlValidator()

Method Details

validate

public void validate(String url)

Description copied from interface: PushNotificationUrlValidator

Validates that the given URL is safe to use as a push notification target.

Specified by:

validate in interface PushNotificationUrlValidator

Parameters:

url - the push notification URL to validate