Patched code sample

import ipaddress
import socket
from urllib.parse import urlparse

# This code represents the logic used to fix the SSRF vulnerability in pyLoad.
# The core of the fix is to validate a URL by resolving its hostname to an IP
# address and checking if that IP belongs to a private, reserved, or local range.
# This prevents the server from making requests to internal network resources.

def is_safe_url(url: str) -> bool:
    """
    Validates if a URL is safe by checking its resolved IP address against
    disallowed network ranges (private, loopback, link-local, etc.).

    This function is a representation of the patch applied in pyLoad 0.5.0b3.dev97.
    """
    try:
        parsed_url = urlparse(url)

        # Disallow URLs without a hostname (e.g., relative paths, file://)
        if not parsed_url.hostname:
            print(f"[-] Denying URL with no hostname: {url}")
            return False

        # Resolve the hostname to an IP address. This is the crucial step.
        # An attacker might use a public domain that resolves to a private IP.
        ip_addr_str = socket.gethostbyname(parsed_url.hostname)
        ip_addr = ipaddress.ip_address(ip_addr_str)

        # Check if the resolved IP address is in a restricted range.
        # This prevents requests to internal services, cloud metadata endpoints, etc.
        if (ip_addr.is_private or
                ip_addr.is_loopback or
                ip_addr.is_link_local or
                ip_addr.is_multicast or
                ip_addr.is_reserved or
                ip_addr.is_unspecified):
            print(f"[-] Denying URL resolving to restricted IP {ip_addr}: {url}")
            return False

    except (socket.gaierror, ValueError) as e:
        # Handle cases where the hostname cannot be resolved or is invalid.
        print(f"[-] Denying URL due to resolution/validation error ({e}): {url}")
        return False

    # If all checks pass, the URL is considered safe.
    print(f"[+] Allowing safe URL: {url}")
    return True

def process_download_request(url: str):
    """
    Simulates the vulnerable part of the application. Before the fix, this
    function would directly attempt to download from any given URL. After the
    fix, it first validates the URL using is_safe_url.
    """
    print(f"\nProcessing request for: {url}")

    # This 'if' condition IS the fix.
    # Without it, any URL would be passed to a download handler,
    # creating the SSRF vulnerability.
    if is_safe_url(url):
        # In a real application, this is where the download would start.
        print(f"    -> Action: Proceeding with download from {url}")
    else:
        # The request is blocked before it can be made.
        print(f"    -> Action: Blocking malicious or unsafe request.")


if __name__ == "__main__":
    # A list of URLs to demonstrate the fix.
    test_urls = [
        # 1. A legitimate, safe URL
        "https://www.python.org/static/img/python-logo.png",

        # 2. SSRF attempt targeting a common private network IP
        "http://192.168.1.1/router/status.html",

        # 3. SSRF attempt targeting the loopback address
        "http://127.0.0.1/sensitive_service/api",
        "http://localhost/secrets.txt",

        # 4. SSRF attempt targeting a cloud metadata service (as described in the CVE)
        "http://169.254.169.254/metadata/v1/user-data",

        # 5. A domain that might resolve to a private IP (requires DNS rebinding or specific DNS setup)
        # For this demonstration, we assume 'internal.service.local' resolves to a private IP if possible.
        # Here, it will likely fail to resolve, which is also a safe outcome.
        "http://my-internal-service.local/data",

        # 6. Invalid URL format
        "not_a_valid_url"
    ]

    print("--- Demonstrating SSRF Fix for pyLoad CVE-2023-33992 ---")
    print("(Note: The original CVE in the prompt was likely a typo)")

    for url in test_urls:
        process_download_request(url)