Patched code sample

from urllib.parse import urlparse, urlunparse

def is_safe_url(url, allowed_schemes=('http', 'https')):
    """
    Checks if a URL is safe to redirect to.

    Args:
        url (str): The URL to check.
        allowed_schemes (tuple): A tuple of allowed schemes (e.g., ('http', 'https')).

    Returns:
        bool: True if the URL is safe, False otherwise.
    """
    try:
        result = urlparse(url)
        return result.scheme in allowed_schemes
    except:
        return False  # Handle parsing errors as unsafe


def safe_redirect(url):
    """
    Safely redirects to the given URL if it is safe.

    Args:
        url (str): The URL to redirect to.

    Returns:
        str: The safe URL or a default URL if the provided URL is unsafe.
    """
    if is_safe_url(url):
        return url
    else:
        return "/default_safe_page"  # Redirect to a safe default page


# Example usage (simulating the fix):
def process_redirect_url(redirect_url):
    return safe_redirect(redirect_url)


if __name__ == '__main__':
    # Vulnerable Example
    # redirect_url = "https://www.example.com" # No URL encoding. This is a safe URL so the below would work if no check.
    # redirect_url = "%68%74%74%70%73%3a%2f%2f%77%77%77%2e%65%78%61%6d%70%6c%65%2e%63%6f%6d"  # URL encoded safe url (example.com)
    # redirect_url = "%68%74%74%70%3a%2f%2f%61%74%74%61%63%6b%2e%63%6f%6d" # URL encoded to attack.com
    # redirect_url = "javascript:alert('XSS')" # javascript payload.

    # Fixed Example using safe_redirect and is_safe_url
    redirect_url = input("Enter the redirect URL: ")
    safe_url = process_redirect_url(redirect_url)

    print(f"Redirecting to: {safe_url}") # print not actually redirecting to avoid automatic redirects to attacker site during testing