Patched code sample

import socket
import ipaddress
import requests
from urllib.parse import urlparse

# An allowlist of trusted hostnames for webhooks
ALLOWED_HOSTS = {'good.example.com', 'api.service.com'}

def send_validated_webhook(url: str, data: dict):
    """
    Parses, validates, and sends a webhook request, preventing SSRF.

    This fixed version introduces two key security controls:
    1. It rejects URLs containing characters known to cause parser confusion.
    2. It resolves the hostname to an IP address and validates that the IP
       is not a private, reserved, or loopback address. This ensures the
       request's true destination is a public server.
    """
    try:
        parsed_url = urlparse(url)

        # 1. Basic validation: ensure scheme and hostname are present.
        if parsed_url.scheme not in ('http', 'https'):
            raise ValueError("Invalid URL scheme. Only http and https are allowed.")

        hostname = parsed_url.hostname
        if not hostname:
            raise ValueError("URL must contain a hostname.")

        # 2. Reject URLs with characters that can cause parser differential issues.
        # The original vulnerability was caused by backslashes in the netloc.
        if '\\' in parsed_url.netloc:
            raise ValueError("Invalid characters in URL authority section.")
            
        # 3. Check hostname against a strict allowlist.
        if hostname not in ALLOWED_HOSTS:
            raise ValueError(f"Hostname '{hostname}' is not in the allowed list.")

        # 4. Resolve the hostname to an IP address to find the true destination.
        # This is the most critical step to mitigate SSRF.
        resolved_ip_str = socket.gethostbyname(hostname)
        resolved_ip = ipaddress.ip_address(resolved_ip_str)

        # 5. Prevent requests to internal/private network addresses.
        if resolved_ip.is_private or resolved_ip.is_loopback or resolved_ip.is_reserved:
            raise ValueError(f"Resolved IP address '{resolved_ip}' is not a public address.")

        # 6. If all checks pass, the URL is considered safe to request.
        print(f"Validation passed. Sending request to {url} (resolved to {resolved_ip}).")
        response = requests.post(url, json=data, timeout=5)
        response.raise_for_status()
        print("Request sent successfully.")
        return response

    except (ValueError, socket.gaierror, requests.exceptions.RequestException) as e:
        print(f"Webhook failed validation or execution: {e}")
        return None

# Example usage demonstrating the fix

# A legitimate URL that will pass validation
# good.example.com must resolve to a public IP for this to work.
# To test, add "1.2.3.4 good.example.com" to your /etc/hosts file.
# send_validated_webhook("https://good.example.com/webhook", data={"status": "ok"})

# A malicious URL attempting to bypass validation.
# urlparse sees 'good.example.com', but requests could be tricked.
# This version catches it with the backslash check.
# send_validated_webhook("https://good.example.com\\@localhost:8000/api", data={"status": "pwned"})

# Another SSRF attempt using a valid but internal-resolving name.
# This is blocked by the IP address check.
# (Assumes 'intranet.service' resolves to a private IP like 192.168.1.10)
# To test, add "192.168.1.10 intranet.service" to your /etc/hosts and 
# 'intranet.service' to ALLOWED_HOSTS.
# send_validated_webhook("http://intranet.service/status", data={"user": "admin"})