Patched code sample

import re

# This code represents the fixed approach, using an allowlist for URL schemes.
# The vulnerability existed because the old code used a blocklist that missed
# several dangerous schemes. The fix was to switch to an allowlist, only
# permitting known safe schemes.

_SAFE_URL_SCHEMES = {
    'http',
    'https',
    'ftp',
    'mailto',
    'tel',
}


def safe_url(url: str) -> str:
    """
    Sanitize a URL by checking its scheme against a predefined allowlist.

    This function represents the logic of the patched code. It parses the
    scheme from the URL and checks if it is present in the `_SAFE_URL_SCHEMES`
    set. If the scheme is not present or if the URL has no scheme (e.g., a
    relative path), it is considered safe. Otherwise, the URL is replaced with
    a sanitized string.
    """
    try:
        scheme, _, _ = url.partition(':')
        # A scheme must contain only alphabetic characters.
        # This is a bit stricter than the spec, but safe.
        if not scheme or (scheme.isalpha() and scheme.lower() in _SAFE_URL_SCHEMES):
            return url
    except ValueError:
        # Fallback for potential parsing errors, though partition is safe.
        pass

    return '#sanitized'

# --- Demonstration of the fix ---

# Vulnerable schemes are now blocked
vulnerable_urls = [
    "javascript:alert('XSS')",
    "vbscript:msgbox('XSS')",
    "data:text/html,<script>alert('XSS')</script>",
    "feed:javascript:alert(1)",
    "view-source:javascript:alert(1)",
    "livescript:alert(1)",
]

# Safe schemes are still allowed
safe_urls = [
    "https://example.com",
    "http://example.com/foo",
    "ftp://user@example.com",
    "mailto:user@example.com",
    "tel:123-456-7890",
    "/relative/path.html",
    "#fragment",
]

print("--- Testing vulnerable URLs (should be sanitized) ---")
for url in vulnerable_urls:
    print(f'"{url}" -> "{safe_url(url)}"')

print("\n--- Testing safe URLs (should pass through) ---")
for url in safe_urls:
    print(f'"{url}" -> "{safe_url(url)}"')