Patched code sample

import ipaddress
from urllib.parse import urlparse, unwrap

# This is a simplified representation of pyLoad's `is_global_host` utility function.
# It returns False for private, reserved, or loopback IP addresses.
def is_global_host(hostname):
    """Checks if the given hostname corresponds to a public IP address."""
    if not hostname:
        return False
    try:
        # The unwrap function is used to handle IPv6-mapped IPv4 addresses like ::ffff:192.0.2.1
        ip = ipaddress.ip_address(unwrap(hostname))
        # The check ensures the IP is public (is_global) and not for multicast.
        return ip.is_global and not ip.is_multicast
    except ValueError:
        # If it's a domain name, not an IP, it's considered valid at this stage.
        # The actual IP resolution would be handled by the subsequent request.
        # The primary concern for this SSRF fix is blocking direct IP redirects.
        return True

# This function simulates the patched redirect handler in pyLoad's HTTPRequest class.
# The original vulnerability was that this function would follow the redirect
# without performing the `is_global_host` check on the new URL.
def handle_redirect_fixed(response_headers):
    """
    Simulates handling an HTTP 3xx redirect by validating the 'Location' header
    before following it, as per the fix for CVE-2023-46561.

    Args:
        response_headers (dict): A dictionary representing the HTTP response headers.

    Raises:
        ValueError: If the redirect points to a non-global/private address.
    """
    new_url = response_headers.get("Location")

    if new_url:
        hostname = urlparse(new_url).hostname

        # --- START OF THE FIX ---
        # The vulnerability was the absence of the following check. The application
        # would blindly follow the redirect, allowing an attacker to point it to
        # an internal network address (e.g., http://192.168.1.1/admin).
        #
        # The fix is to apply the same host validation to the redirect URL
        # that was applied to the initial user-supplied URL.
        if not is_global_host(hostname):
            raise ValueError(
                f"Redirect to non-global address '{hostname}' is not allowed."
            )
        # --- END OF THE FIX ---

        # If the check passes, the application would proceed to make a new
        # request to the `new_url`.
        # print(f"Redirect to safe host '{hostname}' is allowed.")
        pass