Exception: Parse::Embeddings::ConfirmationRequired

Inherits:
Error
  • Object
show all
Defined in:
lib/parse/embeddings.rb

Overview

Raised when trust_provider_url_fetch= is assigned anything other than the deliberate-opt-in sentinel String, or when validate_image_url! is called while the toggle is still off. Sentinel-gated opt-in mirrors Object.acl_off_confirm — a plain true is refused, preventing accidental enablement via Parse::Embeddings.trust_provider_url_fetch = ENV['SOMETHING'] that an operator never intended to set. The only accepted value is the exact frozen String "PROVIDER_EGRESS_VERIFIED".

Threat model: image-URL forwarding hands an attacker-controlled URL (chat input, document field, agent tool argument) to a third-party provider that will then issue an HTTP request from its own network. Even with the SDK's CIDR / port / host allowlist enforced at validation time, the provider's actual fetch happens later (DNS-rebinding window) and can follow redirects the SDK never saw. Forcing operators to set a sentinel that explicitly names the egress risk makes it impossible to enable accidentally.