from urllib.parse import urlparse
import ipaddress
import socket
import requests


def is safe url(url: str) -> tuple[bool, str]:
  """Check if the URL is safe to fetch (not internal/private)."""
  try:
    parsed = urlparse(url)
    if parsed.scheme not in ("http", "https"):
      return False, f"Unsupported scheme: {parsed.scheme}"

    hostname = parsed.hostname
    if not hostname:
      return False, "Could not parse hostname from URL"

    # check all IPs (IPv4 + IPv6) using getaddrinfo
    try:
      infos = socket.getaddrinfo(hostname, None)
    except socket.gaierror:
      return False, "Hostname resolution failed"

    for info in infos:
      ip = ipaddress.ip address(info[4][0])
      # block any IP that is not globally routable (covers private, loopback,
      # link-local, multicast, reserved, unspecified, etc.)
      if not ip.is global:
        return False, f"Blocked non-global IP detected: {ip}"

    return True, "URL is safe"
  except Exception as e:
    return False, f"URL validation failed: {str(e)}"


# url = "http://127.0.0.1:6666"
url = "http://127.0.0.1:6666@1.1.1.1"
is safe, reason = is safe url(url)
if not is safe:
  raise ValueError(f"URL is blocked for security reasons: {reason}")

fetch timeout = 10

client = requests.Session()
client.max redirects = 3
response = client.get(url, timeout=fetch timeout, allow redirects=True)

http://127.0.0.1:6666@1.1.1.1