fix(providers): fail closed when Azure endpoint validates without a pinnable IP

waleedlatif1 · waleedlatif1 · commit c8c48670d2b4 · 2026-06-15T11:38:37.000-07:00
diff --git a/apps/sim/providers/azure-anthropic/index.test.ts b/apps/sim/providers/azure-anthropic/index.test.ts
@@ -104,4 +104,17 @@ describe('azureAnthropicProvider — SSRF pinning', () => {
     expect(mockCreatePinnedFetch).not.toHaveBeenCalled()
     expect(mockExecuteAnthropic).not.toHaveBeenCalled()
   })
+
+  it('fails closed when validation passes but yields no resolvable IP to pin', async () => {
+    mockValidate.mockResolvedValue({ isValid: true })
+
+    await expect(
+      azureAnthropicProvider.executeRequest(
+        request({ azureEndpoint: 'https://rebind.attacker.tld' })
+      )
+    ).rejects.toThrow('could not resolve a pinnable IP address')
+
+    expect(mockCreatePinnedFetch).not.toHaveBeenCalled()
+    expect(mockExecuteAnthropic).not.toHaveBeenCalled()
+  })
 })
diff --git a/apps/sim/providers/azure-anthropic/index.ts b/apps/sim/providers/azure-anthropic/index.ts
@@ -38,9 +38,12 @@ export const azureAnthropicProvider: ProviderConfig = {
         })
         throw new Error(`Invalid Azure Anthropic endpoint: ${validation.error}`)
       }
+      if (!validation.resolvedIP) {
+        throw new Error('Invalid Azure Anthropic endpoint: could not resolve a pinnable IP address')
+      }
       // Pin the connection to the validated IP so the SDK's own DNS resolution at
       // connect time cannot be rebound to an internal address (TOCTOU SSRF).
-      pinnedFetch = createPinnedFetch(validation.resolvedIP!)
+      pinnedFetch = createPinnedFetch(validation.resolvedIP)
     }
 
     const apiKey = request.apiKey
diff --git a/apps/sim/providers/azure-openai/index.test.ts b/apps/sim/providers/azure-openai/index.test.ts
@@ -138,6 +138,19 @@ describe('azureOpenAIProvider — SSRF pinning', () => {
       expect(mockCreatePinnedFetch).not.toHaveBeenCalled()
       expect(mockExecuteResponses).not.toHaveBeenCalled()
     })
+
+    it('fails closed when validation passes but yields no resolvable IP to pin', async () => {
+      mockValidate.mockResolvedValue({ isValid: true })
+
+      await expect(
+        azureOpenAIProvider.executeRequest(
+          request({ azureEndpoint: 'https://rebind.attacker.tld' })
+        )
+      ).rejects.toThrow('could not resolve a pinnable IP address')
+
+      expect(mockCreatePinnedFetch).not.toHaveBeenCalled()
+      expect(mockExecuteResponses).not.toHaveBeenCalled()
+    })
   })
 
   describe('Chat Completions path', () => {
diff --git a/apps/sim/providers/azure-openai/index.ts b/apps/sim/providers/azure-openai/index.ts
@@ -618,9 +618,12 @@ export const azureOpenAIProvider: ProviderConfig = {
         })
         throw new Error(`Invalid Azure OpenAI endpoint: ${validation.error}`)
       }
+      if (!validation.resolvedIP) {
+        throw new Error('Invalid Azure OpenAI endpoint: could not resolve a pinnable IP address')
+      }
       // Pin the connection to the validated IP so the SDK / fetch DNS resolution
       // at connect time cannot be rebound to an internal address (TOCTOU SSRF).
-      pinnedFetch = createPinnedFetch(validation.resolvedIP!)
+      pinnedFetch = createPinnedFetch(validation.resolvedIP)
     }
 
     const apiKey = request.apiKey

Original file line number	Diff line number	Diff line change
`@@ -38,9 +38,12 @@ export const azureAnthropicProvider: ProviderConfig = {`
`38`	`38`	`})`
`39`	`39`	throw new Error(`Invalid Azure Anthropic endpoint: ${validation.error}`)
`40`	`40`	`}`
	`41`	`+ if (!validation.resolvedIP) {`
	`42`	`+ throw new Error('Invalid Azure Anthropic endpoint: could not resolve a pinnable IP address')`
	`43`	`+ }`
`41`	`44`	`// Pin the connection to the validated IP so the SDK's own DNS resolution at`
`42`	`45`	`// connect time cannot be rebound to an internal address (TOCTOU SSRF).`
`43`		`- pinnedFetch = createPinnedFetch(validation.resolvedIP!)`
	`46`	`+ pinnedFetch = createPinnedFetch(validation.resolvedIP)`
`44`	`47`	`}`
`45`	`48`
`46`	`49`	`const apiKey = request.apiKey`
Original file line number	Diff line number	Diff line change
`@@ -618,9 +618,12 @@ export const azureOpenAIProvider: ProviderConfig = {`
`618`	`618`	`})`
`619`	`619`	throw new Error(`Invalid Azure OpenAI endpoint: ${validation.error}`)
`620`	`620`	`}`
	`621`	`+ if (!validation.resolvedIP) {`
	`622`	`+ throw new Error('Invalid Azure OpenAI endpoint: could not resolve a pinnable IP address')`
	`623`	`+ }`
`621`	`624`	`// Pin the connection to the validated IP so the SDK / fetch DNS resolution`
`622`	`625`	`// at connect time cannot be rebound to an internal address (TOCTOU SSRF).`
`623`		`- pinnedFetch = createPinnedFetch(validation.resolvedIP!)`
	`626`	`+ pinnedFetch = createPinnedFetch(validation.resolvedIP)`
`624`	`627`	`}`
`625`	`628`
`626`	`629`	`const apiKey = request.apiKey`