Patched code sample

import ipaddress
import socket
import urllib.parse
from typing import Dict, Optional

import requests
from requests import Session


class DisallowedHostError(Exception):
    pass


def _validate_host(host: Optional[str]) -> None:
    if not host:
        return
    try:
        resolved_ip = socket.gethostbyname(host)
        ip = ipaddress.ip_address(resolved_ip)
        if ip.is_loopback or ip.is_private or ip.is_link_local:
            raise DisallowedHostError(
                f"Host '{host}' resolves to a disallowed IP address: {resolved_ip}"
            )
    except socket.gaierror as e:
        raise DisallowedHostError(f"Host '{host}' could not be resolved.") from e


def get_body(
    url: str,
    headers: Optional[Dict[str, str]] = None,
    ignore_tls: bool = False,
) -> str:
    parsed_url = urllib.parse.urlparse(url)
    if parsed_url.scheme not in ("http", "https"):
        raise ValueError("URL scheme must be http or https")

    # FIX: The hostname is resolved and checked against a blocklist of internal/private IP ranges.
    _validate_host(parsed_url.hostname)

    with Session() as session:
        response = session.get(url, headers=headers, verify=not ignore_tls)
    response.raise_for_status()
    return response.text