I’m writing a function that takes a HTTP request from pip for package names, generating a response in the process. However, GitHub CodeQL does not like it, and warns that it is at risk of server-side request forgery. Is it possible to rewrite the following to satisfy GitHub CodeQL’s requirements, or should I just dismiss the warning?

The relevant block of code:

import requests
from fastapi import APIRouter, HTTPException, Request, Response

pypi = APIRouter(prefix="/pypi", tags=["bootstrap"])

@pypi.get("/{package}/", response_class=Response)
def get_pypi_package_downloads_list(package: str) -> Response:
    """
    Obtain list of all package downloads from PyPI via the simple API (PEP 503).
    """

    # My attempt at URL verification to satisfy GitHub CodeQL requirements
    url = f"https://pypi.org/simple/{package}"
    if "pypi" in url:
        full_path_response = requests.get(url)
    else:
        raise ValueError("This is not a valid package")

Thanks!