(security) Fix SSRF in batch runner download_bytes_from_url

[jperezdealgaba]

Fix an SSRF (Server-Side Request Forgery) vulnerability in the batch runner's download_bytes_from_url function (vllm/entrypoints/openai/run_batch.py).

The file_url field in batch transcription/translation requests (BatchTranscriptionRequest, BatchTranslationRequest) was passed directly to aiohttp.ClientSession().get() without any hostname or domain validation. This allowed anyone who could control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from the server (e.g. targeting cloud metadata endpoints like 169.254.169.254, or internal HTTP APIs).

The online serving path (MediaConnector) already validates URLs against --allowed-media-domains, but download_bytes_from_url did not reuse that protection. This patch closes the gap by:

1. Adding an allowed_media_domains parameter to download_bytes_from_url that validates the URL's hostname against the allowlist before making any HTTP request. Uses urllib3.util.parse_url (consistent with MediaConnector) and normalizes the URL to prevent parsing-discrepancy bypasses (e.g. backslash-@ attacks).
2. Threading allowed_media_domains from the CLI args (--allowed-media-domains) through make_transcription_wrapper and build_endpoint_registry into download_bytes_from_url.
3. Respecting VLLM_MEDIA_URL_ALLOW_REDIRECTS for HTTP redirect control (previously redirects were always followed).
4. Updating docs/usage/security.md to document that the batch runner is also covered by --allowed-media-domains.

data: URLs remain exempt from domain restrictions (they don't make network requests). When no allowlist is configured, behavior is unchanged (backward compatible).

Test Plan

python -m pytest tests/entrypoints/openai/test_run_batch.py -v -k "test_download_bytes" --timeout=30

9 unit tests added covering:

• data: URLs bypass domain restrictions
• Disallowed domains are rejected
• Cloud metadata IP (169.254.169.254) is blocked
• Private-range IPs (10.x, 192.168.x, 127.x) are blocked
• Allowlisted domains are fetched successfully
• No allowlist (None) permits all domains (backward compat)
• Empty allowlist ([]) permits all domains
• Unsupported URL schemes are rejected
• Backslash-@ URL confusion cannot bypass the allowlist

Test Result

tests/entrypoints/openai/test_run_batch.py::test_download_bytes_data_url_bypasses_domain_check PASSED
tests/entrypoints/openai/test_run_batch.py::test_download_bytes_rejects_disallowed_domain PASSED
tests/entrypoints/openai/test_run_batch.py::test_download_bytes_rejects_cloud_metadata_ip PASSED
tests/entrypoints/openai/test_run_batch.py::test_download_bytes_rejects_internal_ip PASSED
tests/entrypoints/openai/test_run_batch.py::test_download_bytes_allows_permitted_domain PASSED
tests/entrypoints/openai/test_run_batch.py::test_download_bytes_no_allowlist_permits_any_domain PASSED
tests/entrypoints/openai/test_run_batch.py::test_download_bytes_empty_allowlist_permits_any_domain PASSED
tests/entrypoints/openai/test_run_batch.py::test_download_bytes_unsupported_scheme PASSED
tests/entrypoints/openai/test_run_batch.py::test_download_bytes_backslash_bypass PASSED
================= 9 passed, 11 deselected, 2 warnings in 1.05s =================

All pre-commit hooks pass (ruff check, ruff format, typos, markdownlint, mypy, SPDX headers, and all project-specific checks).

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[mergify]

Documentation preview: https://vllm--38482.org.readthedocs.build/en/38482/

[gemini-code-assist]

Code Review

This pull request extends SSRF protection to the batch runner by validating media URLs against an allowed domain list and normalizing them to prevent parsing-based bypasses. The changes include documentation, comprehensive security tests, and updates to the transcription/translation wrappers. Feedback points out that an empty allowlist currently permits all domains due to a truthiness check; it is recommended to explicitly check for None so that an empty list correctly denies all requests.