How to Safely Fetch Metadata from User-Submitted URLs (Without Getting Hit by SSRF or DNS Rebinding)

If your app lets a user paste in a URL — a link preview, a "import from website" button, an AI agent...