Vulnerable code sample

import requests
from flask import Flask, Response, request
from urllib.parse import urljoin

# This represents the intended configuration of the proxy.
# The proxy is supposed to forward all requests to this backend service.
TARGET_HOST = "http://internal-service.local:8080/"

app = Flask(__name__)

@app.route('/<path:path>', methods=['GET', 'POST', 'PUT', 'DELETE', 'PATCH'])
def proxy(path):
    """
    This proxy route is vulnerable. It accepts an arbitrary path and joins it
    with the TARGET_HOST. However, urljoin's behavior with an absolute URL
    in the second argument creates an SSRF vulnerability.
    
    Example of intended use:
    GET /api/users -> requests.get("http://internal-service.local:8080/api/users")

    Example of exploit:
    GET /http://attacker.com/data -> requests.get("http://attacker.com/data")
    The TARGET_HOST is completely ignored.
    """
    
    # VULNERABLE LINE: urljoin will discard the base (TARGET_HOST) if the path
    # is an absolute URL (e.g., starts with http:// or https://).
    final_url = urljoin(TARGET_HOST, path)

    # The server then makes a request to the attacker-controlled final_url.
    try:
        # Forward the original request's method, headers, and data.
        resp = requests.request(
            method=request.method,
            url=final_url,
            headers={key: value for (key, value) in request.headers if key != 'Host'},
            data=request.get_data(),
            cookies=request.cookies,
            allow_redirects=False,
            stream=True
        )

        # Stream the response from the target back to the client.
        return Response(
            resp.iter_content(chunk_size=1024),
            status=resp.status_code,
            headers=dict(resp.headers)
        )
    except requests.exceptions.RequestException as e:
        return Response(f"Error proxying request: {e}", status=502)

if __name__ == '__main__':
    # To test:
    # 1. Run this script.
    # 2. In another terminal, run a simple web server, e.g., `python3 -m http.server 9090`
    # 3. Make a request to the proxy: `curl http://127.0.0.1:5000/http://127.0.0.1:9090/`
    # You will see the request logged by the simple web server on port 9090,
    # demonstrating that the proxy made a request to an arbitrary host.
    app.run(port=5000, debug=True)