Vulnerable code sample

import sys
from webob import Request, Response
from wsgiref.simple_server import make_server

# This code requires a vulnerable version of WebOb (< 1.8.10)
# and Python >= 3.10 to demonstrate the vulnerability.

def application(environ, start_response):
    """
    A simple WSGI application that demonstrates the open redirect.
    It takes a 'next' URL parameter and uses it for a redirect.
    """
    request = Request(environ)

    # Get the user-controlled redirect destination from the query string.
    # A malicious user would provide a payload like: \n//evil-site.com
    redirect_destination = request.params.get('next', '/')

    # Create a 302 redirect response.
    response = Response(status=302)

    # VULNERABLE STEP:
    # In WebOb < 1.8.10, setting response.location with a value like
    # '\n//evil-site.com' on Python 3.10+ results in an open redirect.
    # The internal use of urljoin->urlsplit strips the leading newline,
    # reinterpreting the location as a protocol-relative URL to an
    # external domain.
    response.location = redirect_destination

    print(f"Request for: {request.path_qs}")
    print(f"Attempting redirect to: '{redirect_destination}'")
    print(f"Resulting Location header: {response.location}\n")

    return response(environ, start_response)


if __name__ == '__main__':
    port = 8000
    httpd = make_server('', port, application)
    print(f"Serving on port {port}...")
    print("Test the vulnerability with a URL like:")
    print(f"http://localhost:{port}/?next=%0a//google.com")
    print("(%0a is the URL-encoded newline character)")

    try:
        httpd.serve_forever()
    except KeyboardInterrupt:
        print("Server shutting down.")
        httpd.server_close()