Resolved ssrf vulnerability

website/views.py

@@ -156,28 +156,30 @@ def profile_edit(request):
 def add_domain_to_company(request):
     if request.method == "POST":
         domain = request.POST.get("domain")
-        domain = Domain.objects.get(id=domain)
+        try:
+            domain = Domain.objects.get(id=domain)
+        except Domain.DoesNotExist:
+            return HttpResponseBadRequest("Invalid domain ID")
         company_name = request.POST.get("company")
         company = Company.objects.filter(name=company_name).first()
 
-        if not company:
+        try:
             response = requests.get(domain.url)
             soup = BeautifulSoup(response.text, "html.parser")
-            if company_name in soup.get_text():
+        except requests.RequestException as e:
+            messages.error(request, f"Failed to fetch URL: {e}")
+            return redirect("index")
+
+        if company_name in soup.get_text():
+            company = Company.objects.filter(name=company_name).first()
+            if not company:
                 company = Company.objects.create(name=company_name)
-                domain.company = company
-                domain.save()
-                messages.success(request, "Organization added successfully")
-                # back to the domain detail page
-                return redirect("domain", slug=domain.url)
-            else:
-                messages.error(request, "Organization not found in the domain")
-                return redirect("domain", slug=domain.url)
-        else:
             domain.company = company
             domain.save()
             messages.success(request, "Organization added successfully")
-            # back to the domain detail page
+            return redirect("domain", slug=domain.url)
+        else:
+            messages.error(request, "Organization not found in the domain")
             return redirect("domain", slug=domain.url)
     else:
         return redirect("index")
@@ -3348,6 +3350,18 @@ def get(self, request, *args, **kwargs):
         return render(request, self.template_name, context)
 
 
+def is_valid_url(url):
+    try:
+        parsed_url = urlparse(url)
+        if parsed_url.scheme not in ["http", "https"]:
+            return False
+        if re.match(r"^(localhost|127\.|10\.|172\.16\.|192\.168\.)", parsed_url.hostname):
+            return False
+        return True
+    except Exception as e:
+        return False
+
+
 @login_required(login_url="/accounts/login")
 def add_or_update_domain(request):
     if request.method == "POST":
@@ -3365,6 +3379,9 @@ def add_or_update_domain(request):
                     domain.logo = request.FILES["logo"]
                 except:
                     pass
+                if not is_valid_url(request.POST["url"]):
+                    return HttpResponseBadRequest("Invalid or Restricted URL")
+                domain.url = request.POST["url"]
                 domain.save()
                 return HttpResponse("Domain Updated")
             except: