[Vidit Ostwal (Vidit-Ostwal)]

Related issue

Reported by Composio security. No tracking issue yet.

Summary

• The URL read tool tests used a real third-party R2 host and object key as PRESIGNED_URL.
• That fixture is now https://example.com/file?X-Amz-Signature=test.
• The path stays extensionless so the shared cases still sniff the body for PDF, DOCX, HTML, CSV, and XLSX. A .pdf suffix would make the tool trust the path and skip that coverage.

Verification

• Tests added or updated for the changed behavior
• Relevant tests and quality checks pass locally

uv run pytest lib/crewai-tools/tests/url_read_tool_test.py — 73 passed.

Additional context

The signature on the old link was already truncated, so it did not open the file. The storage path was still in the public repo. This removes it from the current tree. The original commit remains in git history.

---

Note

Low Risk
Test-only fixture swap with no production code changes; removes sensitive URL leakage from the repo.

Overview
Replaces the PRESIGNED_URL test fixture, which previously embedded a real Cloudflare R2 host and object path, with a generic https://example.com/file?X-Amz-Signature=test.

A short comment clarifies that the URL stays extensionless on purpose so presigned-style cases keep exercising body sniffing (PDF, DOCX, HTML, CSV, XLSX) instead of relying on a path suffix. No runtime behavior changes—only test data cleanup after a security report.

^{Reviewed by Cursor Bugbot for commit f2e8d0b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[strix-security]

Strix Security Review

Warning

This pull request has 60 commits after the last Strix review (ba34e3d). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

✅ No open security findings.

PR summary: Replaces a real third-party presigned storage URL in the URL read tool tests with a neutral example.com placeholder, keeping the URL extensionless so body-sniffing test coverage is unchanged.

Review summary

The PR replaces a real (truncated) Cloudflare R2 presigned URL used as a test fixture in url_read_tool_test.py with an example.com placeholder, deliberately keeping the path extensionless so the body-sniffing PDF/DOCX/HTML/CSV/XLSX cases still cover extensionless-URL handling. The change is confined to test fixtures: all usages of the constant are behind a patched safe_get_bounded, so no live network requests occur, no leftover copy of the old host, bucket, object key, or signature remains in the tree, and no secret or security control is added or removed. No security issues were found.

_{Review 1 on this PR · ba34e3d · requested Nov 4 08:34 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}