Fix SSRF (Server Side Request Forgery) in Sanic

from sanic import Sanic, response
import httpx
app = Sanic(“VulnerableApp”)
@app.get(“/fetch”)
async def fetch_url(request):
target_url = request.args.get(“url”)
async with httpx.AsyncClient() as client:
# CRITICAL: No validation of the URL scheme, host, or IP range
resp = await client.get(target_url)
return response.text(resp.text)

from sanic import Sanic, response
import httpx
import ipaddress
import socket
from urllib.parse import urlparse
app = Sanic(“SecureApp”)
ALLOWED_SCHEMES = {“http”, “https”}
def is_safe_url(url):
try:
parsed = urlparse(url)
if parsed.scheme not in ALLOWED_SCHEMES:
return False
    # Resolve hostname to IP to prevent DNS Rebinding and internal access
    host_ip = socket.gethostbyname(parsed.hostname)
    ip_obj = ipaddress.ip_address(host_ip)
    
    # Block private, loopback, and link-local addresses
    if ip_obj.is_private or ip_obj.is_loopback or ip_obj.is_link_local:
        return False
    return True
except Exception:
    return False
@app.get(“/fetch”)
async def fetch_url(request):
target_url = request.args.get(“url”)
if not is_safe_url(target_url):
return response.json({“error”: “Invalid or restricted URL”}, status=403)
async with httpx.AsyncClient() as client:
    resp = await client.get(target_url)
    return response.text(resp.text)</code></pre>