Patched code sample

import urllib.parse

def _sanitize_redirect_url(target_url: str) -> str:
    """
    Sanitizes a target URL to prevent open redirection vulnerabilities,
    demonstrating the fix for the vulnerability described in the prompt.

    The vulnerability occurs when an unvalidated `_target_url` parameter is
    used for redirection, allowing redirection to arbitrary external URLs.

    This fix works by parsing the input URL and reconstructing it using only
    the path, query, and fragment components. The scheme (e.g., 'http:', 'https:')
    and netloc (e.g., 'evil-site.com') are deliberately stripped. This ensures
    that any resulting redirect is relative to the current host, preventing
    redirection to external domains.

    Args:
        target_url: The potentially malicious URL from a query parameter.

    Returns:
        A sanitized, relative URL safe for redirection.
    """
    # Parse the provided target URL into its constituent parts.
    # For a URL like "https://evil.com/malicious?q=1", this would be:
    # scheme='https', netloc='evil.com', path='/malicious', query='q=1'
    parsed_url = urllib.parse.urlparse(target_url)

    # Reconstruct the URL using only the 'path', 'params', 'query', and 'fragment'.
    # The 'scheme' and 'netloc' components are explicitly set to empty strings.
    # This effectively strips the domain from the URL, mitigating the open
    # redirect vulnerability.
    safe_url = urllib.parse.urlunparse(
        (
            "",  # scheme is stripped
            "",  # netloc (host/domain) is stripped
            parsed_url.path,
            parsed_url.params,
            parsed_url.query,
            parsed_url.fragment,
        )
    )

    # As a fallback, if the resulting URL is empty or does not start with '/',
    # default to the root path '/'. This handles cases where the input was
    # only a domain (e.g., "http://example.com"), which would become an
    # empty string after sanitization.
    if not safe_url or not safe_url.startswith("/"):
        return "/"

    return safe_url