[github-agentic-autofix]

The scraper accepted user-controlled URLs, creating an SSRF risk. Validate the initial URL and every redirect before making a request.

• URL validation: Permit only HTTP(S) URLs whose hosts resolve exclusively to public IP addresses.
• Redirects: Revalidate each destination and block redirects to non-public hosts.
• Scraper flow: Restore response parsing after the redirect loop so successful fetches return their results.

https://example.com/     → eligible for fetch
http://127.0.0.1/         → blocked
file:///etc/passwd        → blocked