fix: restrict remote media domains

[CUHKSZzxy]

Summary

• Add an allowed_media_domains option for multimodal media URL fetching.
• Enforce exact HTTP(S) media host allowlisting while preserving existing non-global IP blocking.
• Revalidate manual redirects before fetching redirected media URLs.
• Wire the setting through the API server, pipeline, async engines, and multimodal processor.
• Add focused coverage for allowlist matches, rejected domains, unsafe IPs, host confusion, redirects, and multimodal parser forwarding.

Validation

• Focused pytest coverage for media URL safety and multimodal content parsing passed.
• Syntax checks for touched runtime modules passed.
• Diff whitespace check passed.
• Real API-server smoke tests passed for default media URL fetching and allowlisted media URL fetching; non-allowlisted media was rejected during prompt processing.

Assistance

Assisted with Codex + GPT-5.5 xHigh Fast, reviewed manually

[Copilot]

Pull request overview

This PR introduces an exact-host allowlist (allowed_media_domains) for HTTP(S) multimodal media fetching to reduce SSRF risk, and wires that setting from CLI/API entrypoints down into the multimodal processor and URL loader, including manual redirect handling with revalidation.

Changes:

• Add allowed_media_domains plumbed through api_server/engines/pipeline and into MultimodalProcessor + load_from_url.
• Enforce per-request redirect handling (allow_redirects=False) with explicit redirect loops and revalidation on each hop.
• Add/extend tests for allowlist behavior, host confusion attempts, redirects, and forwarding of the allowlist through multimodal parsing; document the CLI flag (zh-cn).

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/test_lmdeploy/test_vl/test_safe_url.py	Adds/updates URL safety tests covering allowlist + redirects + host confusion.
tests/test_lmdeploy/test_content_merge.py	Updates multimodal parsing tests and adds coverage for allowlist forwarding to URL loaders.
lmdeploy/vl/media/connection.py	Implements allowed_media_domains enforcement and manual redirect revalidation for HTTP fetches.
lmdeploy/serve/processors/multimodal.py	Stores/pass-through of allowed_media_domains into load_from_url for all modalities.
lmdeploy/serve/openai/api_server.py	Adds allowed_media_domains parameter to server entrypoint and forwards to engine.
lmdeploy/serve/core/vl_async_engine.py	Wires allowlist into VL async engine + prompt processor.
lmdeploy/serve/core/async_engine.py	Wires allowlist into the default async engine prompt processor.
lmdeploy/pipeline.py	Exposes allowlist on pipeline construction and forwards it to engine.
lmdeploy/cli/serve.py	Adds --allowed-media-domains CLI flag and forwards it to server launch/serve.
lmdeploy/api.py	Exposes allowlist on the public pipeline() API and forwards to Pipeline.
docs/zh_cn/multi_modal/multimodal_inputs.md	Documents the new CLI option and exact-host matching semantics (zh-cn).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lvhan028]

missing the english document

[lvhan028]

Should we use "allowed_media_domains" here?

[lvhan028]

Agent suggests:

Normalize allowed_media_domains at the enforcement point

parse_url() already lowercases the URL host, but allowlist entries are compared as-is (parsed.hostname not in allowed_media_domains). A config like --allowed-media-domains Example.COM would incorrectly reject https://example.com/....