fix(server): validate push-notification URLs at config creation

[SashaMIT]

Summary

The on_create_task_push_notification_config handlers (v1 and v2) stored client-supplied URLs without any validation. A caller who can create a push notification config can point the server at loopback, private-network, link-local, or cloud-metadata hosts, and the server will POST task events to that URL on every state change.

Root cause

src/a2a/server/request_handlers/default_request_handler.py and default_request_handler_v2.py call push_config_store.set_info(task_id, params, context) without checking params.url. The dispatch path (BasePushNotificationSender._dispatch_notification) is covered by #1164; this PR closes the write path.

Fix

• Added push_url_validation_error to base_push_notification_sender.py (same logic as fix(server): validate push-notification URLs before dispatch (SSRF hardening) #1164: blocks non-http(s) schemes, loopback, private, link-local, multicast, reserved, and unresolvable hosts).
• Called it in both on_create_task_push_notification_config handlers before storing the config.
• Raises InvalidParamsError with a descriptive message on rejection.

Testing

• uv run pytest tests/server/request_handlers/ -k push_notification — 55 passed.
• New test: test_on_create_task_push_notification_config_rejects_invalid_url covers loopback and file: scheme rejection.
• Updated existing tests that used unresolvable fixture URLs (1.example.com, callback.com) to use example.com (resolvable in CI).

Relation to #1164

#1164 validates at dispatch time (read path). This PR validates at config creation time (write path). Both are needed: write-time validation fails fast and gives the client immediate feedback; dispatch-time validation is a defense-in-depth backstop.

Made with Cursor

[github-actions]

🧪 Code Coverage (vs main)

⬇️ Download Full Report

	Base	PR	Delta
src/a2a/server/request_handlers/default_request_handler.py	98.13%	98.20%	🟢 +0.07%
src/a2a/server/request_handlers/default_request_handler_v2.py	94.25%	92.89%	🔴 -1.36%
src/a2a/server/tasks/base_push_notification_sender.py	94.44%	85.71%	🔴 -8.73%
Total	93.12%	93.03%	🔴 -0.09%

Generated by coverage-comment.yml

[sokoliva]

Can we rather do something like

push_url_validator: Callable[...] | None = push_url_validation_error ?

A callable lets developers supply their own policy. The spec lists these as checks that SHOULD be done, not MUST and says "implement URL allowlists where appropriate." So the right policy is deployment specific, and the A2A library shouldn't hard-code one.

[sokoliva]

Same as above, something like:

push_url_validator: Callable[...] | None = push_url_validation_error ?

[sokoliva]

We should also add a check before this call.

[sokoliva]

Also check before this call.

[sokoliva]

Can we make this async and use the loop's resolver?

Something like:

 async def push_url_validation_error(url: str) -> str | None:
   ...
   loop = asyncio.get_running_loop()
   infos = await loop.getaddrinfo(host, port, type=socket.SOCK_STREAM)

socket.getaddrinfo is blocking, and both call sites are async def handlers.

[SashaMIT]

Thanks. The library default is now an injectable async push_url_validator (default push_url_validation_error, None skips). Validation runs before both set_info sites, including the send-message path. Resolver uses the running loop's getaddrinfo.