Patched code sample

import requests
import socket
import urllib.parse
from ipaddress import ip_address, AddressValueError

def handle_pdf_document(pdf_url: str):
    """
    Downloads a PDF from a URL and processes it.
    This version includes a fix for a potential SSRF vulnerability.
    """
    try:
        # --- SSRF Fix Start ---
        
        # 1. Parse the URL to isolate the hostname and validate the scheme.
        parsed_url = urllib.parse.urlparse(pdf_url)
        
        if parsed_url.scheme not in ['http', 'https']:
            raise ValueError("Invalid URL scheme. Only 'http' and 'https' are allowed.")
            
        hostname = parsed_url.hostname
        if not hostname:
            raise ValueError("URL is missing a valid hostname.")

        # 2. Resolve the hostname to an IP address. This helps prevent DNS rebinding
        #    attacks where a domain might resolve to a public IP first, then a private one.
        try:
            ip_addr = socket.gethostbyname(hostname)
        except socket.gaierror:
            raise ValueError(f"Could not resolve hostname: {hostname}")
        
        # 3. Check if the resolved IP address is a private, reserved, or loopback address.
        #    This is the core of the SSRF protection.
        ip_obj = ip_address(ip_addr)
        
        # The 'is_global' property is a convenient way to check that the address is not
        # private, reserved, loopback, or otherwise unspecified.
        if not ip_obj.is_global:
            raise ValueError(f"Request to non-global IP address '{ip_addr}' is forbidden.")

        # --- SSRF Fix End ---

        # If all security checks pass, proceed with making the web request.
        # A timeout is crucial to prevent the server from hanging on slow or malicious endpoints.
        with requests.get(pdf_url, stream=True, timeout=10) as response:
            response.raise_for_status()

            # Placeholder for actual PDF processing (e.g., using PyMuPDF/fitz)
            # In a real implementation, you would process the response content here.
            # For demonstration, we'll just confirm successful download.
            print(f"Successfully and securely validated URL. Fetching content from {pdf_url}")
            
            # Example: Reading the first chunk to simulate processing
            first_chunk = next(response.iter_content(chunk_size=1024), None)
            if first_chunk:
                print("PDF content stream started.")
            
            return "Document validation and processing successful."

    except (ValueError, requests.exceptions.RequestException) as e:
        # Catch specific validation, network, or HTTP errors
        return f"Processing failed: {e}"
    except Exception as e:
        # Catch any other unexpected errors during processing
        return f"An unexpected error occurred: {e}"