docs: Add Security comment (SSRF)

open-contracting · Oct 21, 2024 · e699d8b · e699d8b
1 parent b95ba7a
commit e699d8b
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/ocdskit/combine.py b/ocdskit/combine.py
@@ -195,6 +195,7 @@ def merge(
             tag = get_ocds_patch_tag(packager.version)
             if packager.package['extensions']:
                 # `extensions` is an insertion-ordered dict at this point.
+                # Security: Potential SSRF via extension URLs.
                 builder = ProfileBuilder(tag, list(packager.package['extensions']))
                 schema = builder.patched_release_schema()
             else: