# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows use: venv\Scripts\activate

# Install essential security and networking libraries
pip install requests validators pydantic python-dotenv

# Initialize project
npm init -y

# Install dependencies
# axios: for HTTP requests
# validator: for string validation
# dotenv: for environment management
npm install axios validator dotenv

# Install TypeScript types for development
npm install --save-dev typescript @types/node

import requests
import validators
from typing import List
from pydantic import BaseModel, ValidationError, field_validator
from dotenv import load_dotenv
import os

load_dotenv()

# Configuration: Only allow these domains
ALLOWED_DOMAINS = ["api.cisco.com", "internal-voip.corp.local"]

class SecureRequestSchema(BaseModel):
    target_url: str

    @field_validator('target_url')
    @classmethod
    def validate_url_and_domain(cls, v: str) -> str:
        # 1. Check if it's a valid URL format
        if not validators.url(v):
            raise ValueError("Invalid URL format")

        # 2. Prevent SSRF: Check against Allow-list
        # This prevents attackers from hitting localhost or internal IPs
        domain_allowed = any(domain in v for domain in ALLOWED_DOMAINS)
        if not domain_allowed:
            raise ValueError(f"Domain not permitted. Allowed: {ALLOWED_DOMAINS}")
        
        # 3. Prevent Protocol Smuggling (Only allow HTTPS)
        if not v.startswith("https://"):
            raise ValueError("Only HTTPS protocol is permitted for security")
            
        return v

def fetch_voip_data(url: str):
    """
    Fetches data from a validated endpoint.
    """
    try:
        # Validate input through the schema
        validated_data = SecureRequestSchema(target_url=url)
        target = validated_data.target_url

        print(f"[*] Requesting validated target: {target}")
        
        # Perform the request with a strict timeout to prevent DoS
        response = requests.get(target, timeout=5)
        response.raise_for_status()
        
        return response.json()

    except ValidationError as e:
        print(f"[!] Security Validation Error: {e.json()}")
    except requests.exceptions.RequestException as e:
        print(f"[!] Network Error: {e}")
    except Exception as e:
        print(f"[!] Unexpected Error: {e}")
    return None

# --- TEST CASES ---
if __name__ == "__main__":
    print("--- Testing Valid Request ---")
    # This should work if domain is in ALLOWED_DOMAINS
    fetch_voip_data("https://api.cisco.com/v1/status")

    print("\n--- Testing SSRF Attack (Localhost) ---")
    # This should be BLOCKED
    fetch_voip_data("http://127.0.0.1:8080/admin")

    print("\n--- Testing Protocol Smuggling ---")
    # This should be BLOCKED
    fetch_voip_data("ftp://malicious-site.com")

import axios, { AxiosError } from 'axios';
import validator from 'validator';
import * as dotenv from 'dotenv';

dotenv.config();

// Configuration
const ALLOWED_DOMAINS: string[] = ['api.cisco.com', 'internal-voip.corp.local'];

interface FetchResponse {
    data: any;
    status: number;
}

class SecureNetworkClient {
    /**
     * Validates the URL against SSRF patterns and allow-lists
     */
    private validateUrl(url: string): string {
        // 1. Basic URL validation
        if (!validator.isURL(url, { protocols: ['https'], require_protocol: true })) {
            throw new Error("Invalid URL. Only HTTPS is allowed.");
        }

        // 2. Domain Allow-listing
        const parsedUrl = new URL(url);
        const isAllowed = ALLOWED_DOMAINS.some(domain => 
            parsedUrl.hostname === domain || parsedUrl.hostname.endsWith(`.${domain}`)
        );

        if (!isAllowed) {
            throw new Error(`Access Denied: Domain ${parsedUrl.hostname} is not in the allow-list.`);
        }

        return url;
    }

    /**
     * Executes a secure GET request
     */
    public async secureGet(targetUrl: string): Promise<FetchResponse | null> {
        try {
            const validatedUrl = this.validateUrl(targetUrl);

            const response = await axios.get(validatedUrl, {
                timeout: 5000, // 5-second timeout to prevent hanging connections
                maxRedirects: 0 // CRITICAL: Prevent SSRF via Redirects
            });

            return {
                data: response.data,
                status: response.status
            };

        } catch (error) {
            if (axios.isAxiosError(error)) {
                const axiosError = error as AxiosError;
                console.error(`[!] Network Error: ${axiosError.message}`);
            } else {
                console.error(`[!] Security/Validation Error: ${error instanceof Error? error.message : error}`);
            }
            return null;
        }
    }
}

// --- TEST CASES ---
async function runTests() {
    const client = new SecureNetworkClient();

    console.log("--- Test 1: Valid Request ---");
    await client.secureGet("https://api.cisco.com/v1/health");

    console.log("\n--- Test 2: SSRF Attempt (Internal IP) ---");
    await client.secureGet("http://192.168.1.1/admin");

    console.log("\n--- Test 3: SSRF Attempt (Redirect Bypass) ---");
    // Even if the domain looks okay, we disable redirects to prevent jumping to internal IPs
    await client.secureGet("https://evil-redirect-site.com"); 
}

runTests();

# The list of trusted domains (comma-separated)
ALLOWED_DOMAINS=api.cisco.com,internal-voip.corp.local,trusted-partner.com

# API Keys for the actual services
CUCM_API_KEY=your_secure_token_here

# Environment mode
NODE_ENV=production