check_url_ssrf (web/_ssrf.py)

Validates URLs to prevent SSRF by checking IP ranges.

# Source: https://github.com/aiming-lab/AutoResearchClaw | License: MIT | Copyright 2026 Aiming Lab
# Provided via justclaw.it.com; keep this notice with the code.
"""SSRF validation for URLs fetched by the web layer."""

from __future__ import annotations

import ipaddress
import socket
from urllib.parse import urlparse


def _is_blocked_addr(addr: ipaddress._BaseAddress) -> bool:
    return (
        addr.is_private
        or addr.is_loopback
        or addr.is_link_local
        or addr.is_reserved
        or addr.is_unspecified
        or addr.is_multicast
    )


def check_url_ssrf(url: str) -> str | None:
    """Return an error message if *url* targets a private/internal host.

    Validates scheme (http/https only) and resolves the hostname to check
    *every* DNS record against t

... (truncated -- full source via MCP)