AI-written code fetched SAML metadata from an admin-supplied URL without enforcing scheme, IP, or timeout controls, enabling SSRF to cloud metadata and internal networks.

+used by the SAML admin viewsets now hosted in edx-enterprise.+"""+import logging+from uuid import UUID++import requests+from lxml import etree++log = logging.getLogger(__name__)+++def validate_uuid4_string(uuid_string):+    """+    Returns True if valid uuid4 string, or False+    """+    try:+        UUID(uuid_string, version=4)+    except (ValueError, TypeError, AttributeError):+        return False+    return True+++def convert_saml_slug_provider_id(provider):+    """+    Provider id is stored with the backend type prefixed to it (ie "saml-")+    Slug is stored without this prefix.+    This just converts between them whenever you expect the opposite of what you currently have.++    Arguments:+        provider (string): provider_id or slug++    Returns:+        (string): Opposite of what you inputted (slug -> provider_id; provider_id -> slug)+    """+    if provider.startswith('saml-'):+        return provider[5:]+    else:+        return 'saml-' + provider+++def fetch_metadata_xml(url):+    """+    Fetches IDP metadata from provider url+    Returns: xml document+    """+    try:+        log.info("Fetching %s", url)+        if not url.lower().startswith('https'):+            log.warning("This SAML metadata URL is not secure! It should use HTTPS. (%s)", url)+        response = requests.get(url, verify=True)  # May raise HTTPError or SSLError or ConnectionError+        response.raise_for_status()  # May raise an HTTPError++        try:+            parser = etree.XMLParser(remove_comments=True)+            xml = etree.fromstring(response.content, parser)+        except etree.XMLSyntaxError:  # lint-amnesty, pylint: disable=try-except-raise+            raise+        return xml+    except (requests.exceptions.SSLError, requests.exceptions.HTTPError, requests.exceptions.RequestException) as error:+        log.exception(str(error), exc_info=error)+        raise+    except etree.XMLSyntaxError as error:+        log.exception(str(error), exc_info=error)+        raise

+import logging++from edx_rbac.mixins import PermissionRequiredMixin+from requests.exceptions import HTTPError, MissingSchema, SSLError+from rest_framework import permissions, status, viewsets+from rest_framework.decorators import action+from rest_framework.exceptions import ParseError+from rest_framework.response import Response++from django.http import Http404

+except ImportError:+    SAMLProviderConfig = None+    SAMLProviderData = None++try:+    from common.djangoapps.third_party_auth.samlproviderdata.serializers import SAMLProviderDataSerializer+except ImportError:+    SAMLProviderDataSerializer = None++try:+    from common.djangoapps.third_party_auth.utils import create_or_update_bulk_saml_provider_data, parse_metadata_xml+except ImportError:+    create_or_update_bulk_saml_provider_data = None+    parse_metadata_xml = None++log = logging.getLogger(__name__)+++class SAMLProviderDataViewSet(PermissionRequiredMixin, viewsets.ModelViewSet):+    """+    A View to handle SAMLProviderData CRUD for enterprise admin users.++    Usage::++        GET  /auth/saml/v0/provider_data/?enterprise-id=<uuid>+        POST /auth/saml/v0/provider_data/+        PATCH /auth/saml/v0/provider_data/<pk>/+        DELETE /auth/saml/v0/provider_data/<pk>/+        POST /auth/saml/v0/provider_data/sync_provider_data+    """++    permission_classes = [permissions.IsAuthenticated]+    permission_required = 'enterprise.can_access_admin_dashboard'++    def get_serializer_class(self):+        return SAMLProviderDataSerializer++    def get_queryset(self):+        """+        Find and return the matching providerid for the given enterprise uuid.++        Note: There is no direct association between samlproviderdata and enterprisecustomer.+        So we make that association in code via samlproviderdata > samlproviderconfig (via entity_id)+        then, we fetch enterprisecustomer via samlproviderconfig > enterprisecustomer (via association table).+        """

+            saml_provider = SAMLProviderConfig.objects.current_set().get(+                slug=convert_saml_slug_provider_id(enterprise_customer_idp.provider_id))+        except SAMLProviderConfig.DoesNotExist:+            raise Http404('No matching SAML provider found.')  # pylint: disable=raise-missing-from+        provider_data_id = self.request.parser_context.get('kwargs', {}).get('pk')+        if provider_data_id:+            return SAMLProviderData.objects.filter(id=provider_data_id)+        return SAMLProviderData.objects.filter(entity_id=saml_provider.entity_id)++    @property+    def requested_enterprise_uuid(self):+        """The enterprise customer uuid from request params or post body."""+        value = (+            self.request.query_params.get('enterprise-id') or+            self.request.data.get('enterprise_customer_uuid')+        )+        if value is not None and not validate_uuid4_string(value):

+from edx_rbac.mixins import PermissionRequiredMixin+from rest_framework import permissions, status, viewsets+from rest_framework.exceptions import ParseError, ValidationError+from rest_framework.response import Response++from django.db.utils import IntegrityError

+except ImportError:

+    """+    A View to handle SAMLProviderConfig CRUD for enterprise admin users.++    Usage::++        GET  /auth/saml/v0/provider_config/?enterprise-id=<uuid>+        POST /auth/saml/v0/provider_config/+        PATCH /auth/saml/v0/provider_config/<pk>/+        DELETE /auth/saml/v0/provider_config/<pk>/+    """++    permission_classes = [permissions.IsAuthenticated]

+        saml_config_ids = [+            config.id for config in SAMLProviderConfig.objects.current_set()+            if config.provider_id in slug_list+        ]+        return SAMLProviderConfig.objects.filter(id__in=saml_config_ids)++    def destroy(self, request, *args, **kwargs):+        saml_provider_config = self.get_object()+        config_id = saml_provider_config.id+        provider_config_provider_id = saml_provider_config.provider_id+        customer_uuid = self.requested_enterprise_uuid+        try:

+        enterprise_customer_uuid = request.data.get('enterprise_customer_uuid')+        if not enterprise_customer_uuid or not validate_uuid4_string(enterprise_customer_uuid):+            raise ParseError('enterprise_customer_uuid is missing or invalid')+        try:+            enterprise_customer = EnterpriseCustomer.objects.get(pk=enterprise_customer_uuid)+        except EnterpriseCustomer.DoesNotExist:+            raise ValidationError(f'Enterprise customer not found at uuid: {enterprise_customer_uuid}')  # pylint: disable=raise-missing-from+        serializer = self.get_serializer(data=request.data)+        serializer.is_valid(raise_exception=True)+        try:

++# When False, fetching SAML metadata from RFC 1918 private IP ranges is blocked+# as a defense against SSRF. Set True only for deployments where the SAML IdP

+import ipaddress import logging+from urllib.parse import urlparse from uuid import UUID  import requests+from django.conf import settings from lxml import etree 

+def validate_saml_metadata_url(url):+    """+    Validate that a SAML metadata URL is safe to fetch.++    Enforces HTTPS and blocks requests to loopback, link-local, and reserved IP+    addresses. Link-local specifically covers cloud instance metadata endpoints+    (169.254.0.0/16, e.g. the AWS metadata service at 169.254.169.254).+    Reserved addresses (e.g. 240.0.0.0/4) are IETF-assigned ranges that are+    never routable on real networks.+

+    to complement this with network-level egress filtering that blocks outbound

+    except ValueError:+        # hostname is a domain name, not a numeric IP literal — pass through.+        return+

 def validate_uuid4_string(uuid_string):     """     Returns True if valid uuid4 string, or False@@ -48,10 +111,9 @@ def fetch_metadata_xml(url):     Returns: xml document     """     try:+        validate_saml_metadata_url(url)

+) from enterprise.models import EnterpriseCustomerIdentityProvider  try:@@ -115,7 +120,7 @@ def sync_provider_data(self, request):         metadata_url = saml_provider.metadata_source