Patched code sample

import urllib.parse
import requests
import os

def save_url_to_cache_fixed(url, cache_dir="."):
    """
    Downloads a file from a URL and saves it to a local cache,
    with SSRF protection.
    """
    try:
        parsed_url = urllib.parse.urlparse(url)

        # SSRF Protection: Check allowed schemes and domains
        allowed_schemes = ["http", "https"]
        allowed_domains = ["example.com", "example.org", "gradio.app"] # Replace with your allowed domains

        if parsed_url.scheme not in allowed_schemes:
            raise ValueError(f"Invalid scheme: {parsed_url.scheme}. Allowed schemes are: {allowed_schemes}")

        if parsed_url.hostname not in allowed_domains:
            raise ValueError(f"Invalid domain: {parsed_url.hostname}. Allowed domains are: {allowed_domains}")

        # Further validation - prevent file:///  or other local access schemes slipping through.
        if parsed_url.scheme not in ('http', 'https'):
            raise ValueError("Only http or https URLs are allowed.")

        # Prevent path traversal attacks.  Crucially important.
        # This is an extra layer on top of scheme/domain validation.
        if ".." in parsed_url.path:
            raise ValueError("Path traversal detected.")


        response = requests.get(url, stream=True)
        response.raise_for_status()  # Raise HTTPError for bad responses (4xx or 5xx)

        filename = os.path.basename(parsed_url.path)
        filepath = os.path.join(cache_dir, filename)

        with open(filepath, "wb") as f:
            for chunk in response.iter_content(chunk_size=8192):
                f.write(chunk)

        return filepath
    except Exception as e:
        print(f"Error downloading {url}: {e}")
        return None

if __name__ == '__main__':
    # Example usage
    # Replace with a URL that *should* be allowed based on the filters above
    allowed_url = "https://example.com/somefile.txt"
    cached_file = save_url_to_cache_fixed(allowed_url)
    if cached_file:
        print(f"File downloaded and cached at: {cached_file}")

    # Example of a blocked URL (SSRF protection)
    blocked_url = "file:///etc/passwd"  # Simulate SSRF attempt
    cached_file = save_url_to_cache_fixed(blocked_url) # This should throw error because of file:/// scheme

    # Example of a blocked URL (SSRF protection, different domain)
    blocked_url = "https://malicious.com/somefile.txt"  # Simulate SSRF attempt
    cached_file = save_url_to_cache_fixed(blocked_url) # This should throw error because of unallowed domain

    # Example of a blocked URL (Path traversal protection)
    blocked_url = "https://example.com/../../etc/passwd"
    cached_file = save_url_to_cache_fixed(blocked_url)