Fix code scanning alert no. 11: Full server-side request forgery

[AJaySi]

Fixes https://github.com/AJaySi/AI-Writer/security/code-scanning/11

To fix the problem, we need to ensure that the user-provided URL is validated against a list of authorized domains. This can be achieved by maintaining a list of allowed domains and checking if the user-provided URL belongs to one of these domains before making the request.

1. Create a list of authorized domains.
2. Parse the user-provided URL and extract the domain.
3. Check if the extracted domain is in the list of authorized domains.
4. If the domain is not authorized, display an error message and stop the execution.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[AJaySi]

@uniqueumesh
Please Approve.

[uniqueumesh]

# --- Analyze Button & Processing --- 

# List of authorized domains
AUTHORIZED_DOMAINS = ["example.com", "another-example.com"]

def is_valid_url(url):
    """
    Validates if the URL is well-formed and starts with http:// or https://.
    """
    if not url.startswith(("http://", "https://")):
        return False, "Invalid URL! Please ensure it starts with 'http://' or 'https://'."
    return True, None

def is_authorized_domain(url, authorized_domains):
    """
    Checks if the URL's domain is in the list of authorized domains.
    """
    domain = url.split("//")[-1].split("/")[0]
    if not any(domain.endswith(auth_domain) for auth_domain in authorized_domains):
        return False, f"Unauthorized domain! Allowed domains are: {', '.join(authorized_domains)}."
    return True, None

if st.button("Analyze with AI!"):
    with st.spinner('Analyzing your content...'):
        url = url_input.strip()

        # Validate URL format
        is_valid, error_message = is_valid_url(url)
        if not is_valid:
            st.error(error_message)
            st.stop()

        # Check if the domain is authorized
        is_auth, error_message = is_authorized_domain(url, AUTHORIZED_DOMAINS)
        if not is_auth:
            st.error(error_message)
            st.stop()

        # Fetch webpage content
        try:
            response = requests.get(url)
            response.raise_for_status()
            # Add your content analysis logic here
            st.success("Content analysis completed successfully!")
        except requests.RequestException as e:
            st.error(f"Failed to fetch the webpage. Error: {e}")