Description:

• _is_azure_blob_url derived the host by manually splitting netloc on ":", which mis-parses URLs that embed userinfo (user@host). A crafted URL such as https://a.blob.core.windows.net:80@127.0.0.1:6666 was classified as an allowed Azure Blob URL even though the real host is 127.0.0.1, letting the allowlist be bypassed and enabling an SSRF via _sign_blob_url_async. This replaces the hand-rolled parsing with urlparse(...).hostname.

Changes

• pyrit/backend/mappers/attack_mappers.py — use parsed.hostname (RFC 3986-aware) instead of parsed.netloc.split(":")[0], and add a bool(host) guard since hostname returns None for unparseable input. This is because netloc.split(":")[0] stops at the first colon and returns the user portion of user@host, so the blob-looking credential segment was treated as the host. .hostname returns the actual connection target, correctly failing the .blob.core.windows.net suffix check.

Tests and Documentation

• tests/unit/backend/test_mappers.py — add a regression test asserting the userinfo-spoofed payload is rejected.