fix(core): add init validator and serialization mappings for Bedrock models

[michaelnchin]

Context in langchain-aws release 1.1.2 PR: langchain-ai/langchain-aws#821

Updates the trusted partner serializer mappings to unblock chat model standard tests for ChatBedrockConverse on langchain-core>=1.2.5.

Additionally, implements SSRF protection for AWS Bedrock models by introducing a class-specific validator system that blocks deserialization when endpoint_url or base_url parameters are present.

[codspeed-hq]

CodSpeed Performance Report

Merging #34510 will not alter performance

_{Comparing michaelnchin:chatbedrockconverse-ser-mapping (5090786) with master (2bbe421)}

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

Summary

✅ 13 untouched
⏩ 21 skipped¹

Footnotes

1. 21 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[mdrxy]

ChatBedrockConverse makes network calls during __init__ (via get_inference_profile() in model validators), and the destination is attacker-controllable through the endpoint_url/base_url kwarg. Adding this class to trusted serialization mappings enables SSRF attacks when deserializing untrusted data—an attacker can craft a payload that forces the server to make HTTP requests to arbitrary endpoints, potentially exfiltrating AWS credentials on EC2/Lambda instances with IAM roles. We should probably add an init_validator. See default_init_validator in load.py for more info.

[michaelnchin]

Thank you for the feedback @mdrxy !

I've added a custom _bedrock_validator in a new validators.py file, which also builds out a more general CLASS_INIT_VALIDATORS object containing additional class<->validator mappings, to be used by load alongside default_init_validator. Also, I've applied to the validator to the existing BedrockLLM and ChatBedrock mappings, as they appear to have the same endpoint_url/base_url vector.