Fix security vulnerability and bugs in Ollama API integration

[Mirza-Samad-Ahmed-Baig]

Description

This PR addresses critical security vulnerabilities and functional bugs in the Ollama language model integration, specifically in the _ollama_query method within langextract/inference.py.

---

Issues Fixed

SSRF Vulnerability (Server-Side Request Forgery)

• Problem: Unsafe URL construction using string concatenation allowed for potential SSRF attacks.
• Fix:
  • Only http and https schemes are allowed.
  • Ensures hostname is present.
  • Uses urllib.parse.urljoin() for safe URL construction.
  • Disallows unsafe schemes like file://, ftp://, etc.

---

Typo in Parameter Name

• Problem: Incorrect parameter 'num_thread' used instead of 'num_threads'.
• Fix: Renamed to 'num_threads' to match the Ollama API specification.
• Impact: Thread count was ignored during inference calls.

---

Incorrect Variable in API Call

• Problem: After constructing api_endpoint, the code erroneously used model_url in the API request.
• Fix: Corrected the call to use api_endpoint.
• Impact: API requests were made to an incorrect URL path.

---

Double-Slash in URLs

• Problem: String concatenation could result in malformed URLs (e.g., //api/generate).
• Fix: Replaced with urljoin() which handles trailing slashes safely.

---

Issue: #89

Changes Summary

• Improved security by preventing SSRF.
• Corrected parameter usage for thread control.
• Corrected URL routing to API endpoints.
• Safer and cleaner URL construction using standard library.

---

Example Attack Prevention

Before (Vulnerable):

model_url = "file:///etc/passwd"
model_url = "http://internal-service.local"
model_url = "ftp://attacker.com"


## How Has This Been Tested?

- [x] Manual Testing: Verified the fix using various URL formats (with/without trailing slashes), invalid URL schemes, and malicious URL patterns.
- [x] Functional Verification: Confirmed that the `num_threads` parameter is passed correctly to the Ollama API.
- [x] Error Handling: Confirmed proper exceptions are raised for invalid or unsafe URLs.
- [x] Automated Testing: All existing unit tests were run to ensure no regressions.
- [x] Test Environment: Local development environment on Windows.
- [x] Test Command: `python -m tox`

## Checklist

- [x] My code follows the style guidelines of this project  
- [x] I have performed a self-review of my code  
- [x] I have commented the code, especially in hard-to-understand areas  
- [ ] I have updated the documentation if necessary  
- [x] My changes do not introduce new warnings  
- [x] I have added or updated tests that verify my changes  
- [x] All tests pass locally  
- [ ] Any dependent changes have been merged and published

[github-actions]

Manual validation results:

Size: 17 lines
Template: ✗
Linked issue: ✗

Run ID: 16790883101

[github-actions]

Manual validation results:

Size: 17 lines
Template: ✗
Linked issue: ✗

Run ID: 16791204550

[github-actions]

Manual Validation Results

Status: ❌ Failed

Check	Status	Details
PR Size	✅	17 lines
Template	❌	Missing required sections
Linked Issue	❌	Missing Fixes/Closes #XXX

Errors:

• ❌ Missing PR template sections: # Description, Fixes #, # How Has This Been Tested?, # Checklist
• ❌ No linked issue found

View workflow run

[github-actions]

⚠️ Branch Update Required

Your branch is 21 commits behind main. Please update your branch to ensure CI checks run with the latest code:

git fetch origin main
git merge origin/main
git push

Note: Enable "Allow edits by maintainers" to allow automatic updates.

[github-actions]

No linked issues found. Please add the corresponding issues in the pull request description.
Use GitHub automation to close the issue when a PR is merged

[github-actions]

⚠️ Branch Update Required

Your branch is 25 commits behind main. Please update your branch to ensure CI checks run with the latest code:

git fetch origin main
git merge origin/main
git push

Note: Enable "Allow edits by maintainers" to allow automatic updates.

[github-actions]

⚠️ Branch Update Required

Your branch is 86 commits behind main. Please update your branch to ensure CI checks run with the latest code:

git fetch origin main
git merge origin/main
git push

Note: Enable "Allow edits by maintainers" to allow automatic updates.

[github-actions]

⚠️ Branch Update Required

Your branch is 98 commits behind main. Please update your branch to ensure CI checks run with the latest code:

git fetch origin main
git merge origin/main
git push

Note: Enable "Allow edits by maintainers" to allow automatic updates.

[github-actions]

⚠️ Branch Update Required

Your branch is 106 commits behind main. Please update your branch to ensure CI checks run with the latest code:

git fetch origin main
git merge origin/main
git push

Note: Enable "Allow edits by maintainers" to allow automatic updates.

[github-actions]

⚠️ Branch Update Required

Your branch is 107 commits behind main. Please update your branch to ensure CI checks run with the latest code:

git fetch origin main
git merge origin/main
git push

Note: Enable "Allow edits by maintainers" to allow automatic updates.

[github-actions]

⚠️ Branch Update Required

Your branch is 109 commits behind main. Please update your branch to ensure CI checks run with the latest code:

git fetch origin main
git merge origin/main
git push

Note: Enable "Allow edits by maintainers" to allow automatic updates.

[github-actions]

⚠️ Branch Update Required

Your branch is 110 commits behind main. Please update your branch to ensure CI checks run with the latest code:

git fetch origin main
git merge origin/main
git push

Note: Enable "Allow edits by maintainers" to allow automatic updates.

[github-actions]

⚠️ Branch Update Required

Your branch is 111 commits behind main. Please update your branch to ensure CI checks run with the latest code:

git fetch origin main
git merge origin/main
git push

Note: Enable "Allow edits by maintainers" to allow automatic updates.