Patched code sample

import socket
from ipaddress import ip_address
from typing import Optional, Tuple
from urllib.parse import urlparse

# This script demonstrates the fix for CVE-2024-30272 (incorrectly listed
# as CVE-2026-40072 in the prompt) in web3.py. The vulnerability was a
# Server-Side Request Forgery (SSRF) in the CCIP-Read (EIP-3668) implementation.
#
# The fix introduces a validation function that is called before any
# HTTP request is made to a URL provided by a smart contract. This script
# contains the core logic of that validation function and demonstrates how
# it prevents requests to internal or forbidden destinations.

# --- Start of the Code Representing the Fix ---

# Custom exception defined in web3.py for this specific error case.
class CCIPReadForbidden(Exception):
    """
    Raised when a CCIP-Read URL is forbidden due to failing validation.
    """
    pass

def _validate_ccip_read_url(
    url: str,
    whitelisted_ccip_read_domains: Optional[Tuple[str, ...]] = None,
) -> None:
    """
    Validates a URL before it is used for a CCIP-Read request. This function
    is the core of the SSRF vulnerability fix introduced in web3.py.

    It performs the following checks:
    1. If a whitelist of domains is provided, it ensures the URL's hostname
       is in that whitelist.
    2. It restricts the URL scheme to 'http' or 'https'.
    3. It resolves the URL's hostname to an IP address and blocks any requests
       to private, loopback, or unspecified IP addresses to prevent access to
       internal network resources.
    """
    try:
        parsed_url = urlparse(url)
    except Exception as e:
        raise CCIPReadForbidden(f"URL cannot be parsed: {url}") from e

    # 1. Check against whitelisted domains if a whitelist is configured.
    if whitelisted_ccip_read_domains:
        if not parsed_url.hostname or parsed_url.hostname not in whitelisted_ccip_read_domains:
            raise CCIPReadForbidden(
                f"URL hostname '{parsed_url.hostname}' is not in the CCIP-Read "
                "whitelisted domains."
            )
        # If whitelisted, no further IP-based checks are needed.
        return

    # 2. Check for allowed schemes.
    if parsed_url.scheme not in ("http", "https"):
        raise CCIPReadForbidden(f"URL scheme '{parsed_url.scheme}' is not allowed.")

    if not parsed_url.hostname:
        raise CCIPReadForbidden(f"URL does not contain a hostname: {url}")

    # 3. Resolve hostname and check for forbidden IP addresses.
    try:
        # Use socket.getaddrinfo to resolve the hostname to IP addresses.
        # We check all resolved addresses for safety.
        addr_info = socket.getaddrinfo(parsed_url.hostname, parsed_url.port, 0, socket.SOCK_STREAM)
        resolved_ips = {info[4][0] for info in addr_info}

        for ip_str in resolved_ips:
            ip = ip_address(ip_str)
            if ip.is_private or ip.is_loopback or ip.is_unspecified:
                raise CCIPReadForbidden(
                    f"URL '{url}' resolves to a forbidden IP address: {ip}"
                )
    except socket.gaierror as e:
        raise CCIPReadForbidden(f"Could not resolve hostname for URL: {url}") from e


def process_ccip_read_request_fixed(url: str):
    """
    Simulates the fixed process for handling a CCIP-Read URL.
    It calls the validation function before attempting to make a request.
    """
    print(f"\n[FIXED] Processing URL: {url}")
    try:
        # This is the crucial step that fixes the vulnerability.
        _validate_ccip_read_url(url)
        print(f"SUCCESS: URL '{url}' is valid. A request would be sent.")
        # In the actual web3.py, an HTTP request would be made here.
        # e.g., session.get(url)
    except CCIPReadForbidden as e:
        print(f"FAILURE: URL '{url}' is blocked. Reason: {e}")


def process_ccip_read_request_vulnerable(url: str):
    """
    Simulates the vulnerable process. It would make the request directly without
    any validation, leading to SSRF.
    """
    print(f"\n[VULNERABLE] Processing URL: {url}")
    print(f"-> No validation performed. An HTTP request would be sent directly to '{url}'.")
    # In a vulnerable version, the request would be made here,
    # potentially targeting an internal service.


if __name__ == "__main__":
    # A list of URLs that a malicious smart contract might return for CCIP-Read.
    test_urls = [
        # A legitimate, public URL
        "https://example.com/api/data.json",
        # A URL pointing to a local service (SSRF attempt)
        "http://127.0.0.1/admin",
        # A URL pointing to an internal network service (SSRF attempt)
        "https://192.168.1.1/internal_api",
        # A URL pointing to a cloud metadata service (SSRF attempt)
        "http://169.254.169.254/latest/meta-data/",
        # A URL with a disallowed scheme
        "file:///etc/passwd",
        # A URL with a non-resolvable hostname
        "http://thishostnamedoesnotexist.xyz/",
    ]

    print("--- Demonstrating Vulnerable Behavior (Representation) ---")
    for url in test_urls:
        process_ccip_read_request_vulnerable(url)

    print("\n\n--- Demonstrating Fixed Behavior ---")
    for url in test_urls:
        process_ccip_read_request_fixed(url)

    # --- Demonstrate whitelisting behavior, also part of the fix ---
    print("\n\n--- Demonstrating Fixed Behavior with Whitelist Configured ---")
    whitelisted_domains = ("my-safe-gateway.com",)

    def process_ccip_read_with_whitelist(url: str):
        print(f"\n[WHITELIST] Processing URL: {url}")
        try:
            _validate_ccip_read_url(
                url, whitelisted_ccip_read_domains=whitelisted_domains
            )
            print(f"SUCCESS: URL '{url}' is valid as its domain is whitelisted.")
        except CCIPReadForbidden as e:
            print(f"FAILURE: URL '{url}' is blocked. Reason: {e}")

    whitelisted_test_urls = [
        "https://my-safe-gateway.com/lookup", # Should be allowed
        "https://example.com/api/data.json", # Should be blocked (not in whitelist)
    ]
    for url in whitelisted_test_urls:
        process_ccip_read_with_whitelist(url)

# --- End of the Code Representing the Fix ---