Patched code sample

import requests
from urllib.parse import urlparse

# A vulnerability in a component like 'utcp-gql/utcp-websocket' could involve
# processing a user-provided URL without validation, leading to SSRF.
# The fix involves strictly validating the URL against an allow-list before making a request.

# Define a strict allow-list of trusted hostnames the server is permitted to contact.
# This is the core of the SSRF fix.
ALLOWED_REQUEST_HOSTNAMES = {
    "api.trusted-partner.com",
    "resources.internal-service.local",
    "data.example.org",
}

def fetch_resource_safely(url_from_user: str) -> dict:
    """
    Fetches a resource from a URL only if it is in the allowed list.
    This function represents the fix for a potential SSRF vulnerability.
    """
    try:
        parsed_url = urlparse(url_from_user)

        # 1. Validate the scheme.
        if parsed_url.scheme not in ["http", "https"]:
            return {"status": "error", "message": "Invalid URL scheme."}

        # 2. Validate the hostname against the strict allow-list.
        if parsed_url.hostname not in ALLOWED_REQUEST_HOSTNAMES:
            return {"status": "error", "message": f"Host '{parsed_url.hostname}' is not allowed."}

        # 3. If validation passes, proceed with the request.
        # The SSRF vulnerability is prevented because the request can only be sent
        # to pre-approved, trusted hosts.
        response = requests.get(url_from_user, timeout=5, allow_redirects=False)
        response.raise_for_status()

        return {"status": "success", "content_length": len(response.content)}

    except requests.RequestException as e:
        return {"status": "error", "message": f"Request failed: {str(e)}"}
    except (ValueError, AttributeError):
        # Catches malformed URLs that urlparse might fail on.
        return {"status": "error", "message": "Malformed URL provided."}