[github-agentic-autofix]

User-controlled scraper URLs could target internal services, including through DNS rebinding or redirects. Validate each destination and bind its connection to a public IP address.

• Validate and pin: Allow only HTTP(S), reject credentials and non-public DNS results, and connect to a validated IP while retaining the original hostname for Host and TLS SNI.
• Revalidate redirects: Validate and pin each redirect destination; disable environment proxies that could bypass the pin.
• Restore parsing: Run response parsing after the redirect loop so successful fetches return scraper results.

For https://example.com/path, the request connects to the validated IP while keeping Host: example.com and SNI example.com.