Patched code sample

import os
from urllib.parse import urlsplit

# In a real Tautulli application, this information would be retrieved
# from the application's configuration.
# We simulate it here for demonstration purposes.
PLEX_CONFIG = {
    'host': '192.168.1.100',
    'port': 32400,
    'use_ssl': False
}

def get_plex_server_netloc():
    """
    Constructs the network location (hostname:port) of the configured
    Plex Media Server. This is used as a whitelist for allowed requests.
    """
    scheme = "https" if PLEX_CONFIG['use_ssl'] else "http"
    host = PLEX_CONFIG['host']
    port = PLEX_CONFIG['port']
    
    # Create a full URL and parse it to reliably get the netloc
    full_url = f"{scheme}://{host}:{port}"
    return urlsplit(full_url).netloc

def pms_image_proxy_fixed(img_url_param):
    """
    A representation of the fixed /pms_image_proxy endpoint.

    This function validates that the user-supplied 'img' parameter points
    explicitly to the configured Plex Media Server, preventing Server-Side
    Request Forgery (SSRF) attacks.
    """
    try:
        # Get the allowed network location (e.g., '192.168.1.100:32400')
        plex_server_netloc = get_plex_server_netloc()

        # Parse the URL provided by the user
        parsed_img_url = urlsplit(img_url_param)

        # 1. Validate the scheme is either http or https.
        if parsed_img_url.scheme not in ('http', 'https'):
            # The scheme is invalid (e.g., 'file://'), so reject the request.
            # In a web framework, this would return a 400 Bad Request.
            return None

        # 2. THE FIX: Validate that the hostname and port of the user-supplied
        # URL exactly match the configured Plex Media Server's hostname and port.
        if parsed_img_url.netloc != plex_server_netloc:
            # Hostname/port mismatch. This is a potential SSRF attack.
            # Reject the request.
            # In a web framework, this would return a 400 Bad Request.
            return None

        # If both checks pass, the URL is considered safe to forward to Plex.
        # The logic to proxy the request to the Plex transcoder would go here.
        print(f"Validation successful: Forwarding request for '{img_url_param}'")
        return img_url_param

    except (ValueError, TypeError):
        # Handle malformed or non-string URLs.
        # In a web framework, this would return a 400 Bad Request.
        return None

# --- Demonstration of the fix ---

# Example 1: A legitimate request for an image on the configured Plex server.
# This request will be allowed.
legitimate_url = "http://192.168.1.100:32400/photo/:/transcode?width=150&height=150&url=/library/metadata/123/thumb/456"
pms_image_proxy_fixed(legitimate_url)

print("-" * 20)

# Example 2: An SSRF attempt to target an external, attacker-controlled server.
# This request will be blocked by the hostname check.
ssrf_external_url = "http://attacker-website.com/collect_data"
if not pms_image_proxy_fixed(ssrf_external_url):
    print(f"Blocked malicious request to external host: '{ssrf_external_url}'")

print("-" * 20)

# Example 3: An SSRF attempt to target a different internal service (e.g., a router).
# This request will also be blocked by the hostname check.
ssrf_internal_url = "http://192.168.1.1/admin"
if not pms_image_proxy_fixed(ssrf_internal_url):
    print(f"Blocked malicious request to internal host: '{ssrf_internal_url}'")