Patched code sample

import smtplib
import socket
import ipaddress
from typing import List

# Simplified representation of the platform's SSRF protection blocklist,
# as mentioned in the CVE description.
BLOCKED_IP_NETWORKS: List[ipaddress.IPv4Network | ipaddress.IPv6Network] = [
    ipaddress.ip_network("127.0.0.0/8"),  # Loopback
    ipaddress.ip_network("10.0.0.0/8"),  # Private
    ipaddress.ip_network("172.16.0.0/12"),  # Private
    ipaddress.ip_network("192.168.0.0/16"),  # Private
    ipaddress.ip_network("169.254.0.0/16"),  # Link-local
    ipaddress.ip_network("0.0.0.0/8"),  # Reserved
    ipaddress.ip_network("::1/128"),  # IPv6 Loopback
    ipaddress.ip_network("fc00::/7"),  # IPv6 Unique Local
    ipaddress.ip_network("fe80::/10"),  # IPv6 Link-local
]


def validate_host_ip(host: str):
    """
    Resolves a hostname to an IP address and checks it against the blocklist.
    This function represents the core of the fix, applying security checks
    that were previously bypassed.
    """
    try:
        ip_info = socket.getaddrinfo(host, 0, family=socket.AF_UNSPEC)
        # Use the first resolved IP address for validation
        ip_str = ip_info[0][4][0]
        ip_addr = ipaddress.ip_address(ip_str)

        for blocked_net in BLOCKED_IP_NETWORKS:
            if ip_addr in blocked_net:
                raise ConnectionRefusedError(
                    f"Connection to {host} ({ip_addr}) is forbidden."
                )
    except socket.gaierror as e:
        raise ConnectionRefusedError(f"Could not resolve hostname: {host}") from e


class SendEmailBlock:
    """
    A representative example of the fixed SendEmailBlock.
    """
    def execute(self, smtp_server: str, smtp_port: int):
        """
        Executes the email sending logic with SSRF protection.
        """
        try:
            # FIX: The user-supplied smtp_server is now validated against a
            # blocklist of reserved IP ranges before any connection is attempted.
            validate_host_ip(smtp_server)

            # The original vulnerable call, now safe to execute after validation.
            with smtplib.SMTP(smtp_server, smtp_port, timeout=5) as server:
                # In a real implementation, server.login() and server.sendmail()
                # would be called here.
                print(f"Successfully connected to {smtp_server}:{smtp_port}")
                return "Connection successful (simulation)."

        except (ConnectionRefusedError, smtplib.SMTPException, socket.timeout) as e:
            # The exception now comes from our validation or a legitimate
            # connection issue, not from scanning an internal network.
            print(f"Failed to connect: {e}")
            return f"Failed to connect: {e}"

# Example Usage:
# if __name__ == "__main__":
#     fixed_block = SendEmailBlock()
#
#     # This call will be blocked by the new validation logic.
#     print("--- Attempting to connect to a blocked address ---")
#     fixed_block.execute(smtp_server="127.0.0.1", smtp_port=25)
#
#     print("\n--- Attempting to connect to a valid public address ---")
#     # This call will pass validation but may fail to connect if the server
#     # is not a real SMTP server, which is expected behavior.
#     fixed_block.execute(smtp_server="smtp.gmail.com", smtp_port=587)