[Python] Problems handling SSRF vulnerability on api rest request

I'm strugging to remove a SSRF vulnerability detected by checkmarx as part of our ci/cd pipeline at work and i have little knowledge about fixing this kind of problem (this vulnerability prevents me from continuing with the pipeline).

I'm calling an internal rest service that stores files to download a single file based on the file_id (uuid4) param. I've added multiple redundant validations to make sure that the file_id is right before adding it to the url. The hostname is passed from a configmap. Is there a better way to fix this and prevent checkmarx detecting it?

import os
import re
import uuid
import validators
import requests

UUID_REGEX = r'^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$'


def download_file(file_id): # <-- Attack vector starts here
if not re.match(UUID_REGEX, file_id):
raise ValueError('invalid file_id')

if not validators.uuid(file_id):
raise ValueError('invalid file_id')

try:
file_id = str(uuid.UUID(file_id))
except Exception:
raise ValueError('invalid file_id')

hostname = os.getenv('HOSTNAME', None)

if hostname is None:
raise ValueError('invalid file_id')

url = f'https://{hostname}/v1/files/{file_id}'

response = requests.get(url) # <-- Attack vector ends here

if response.status_code == 200:
pass

Continue reading...