Private ip addresses being validated with public=True

[joaonevess]

https://github.com/kvesteri/validators/blob/4afa24372586aed4930e865d5904eed31013fe81/validators/url.py#L146

There is no guarantee that setting this flag to True will get a "public IP address". A domain might point to private IP addresses, (like vcap.me which points to 127.0.0.1), so trusting public=True could lead to security issues

>>> url("https://127.0.0.1", public=True)
False
>>> url("http://vcap.me", public=True)
True

[danielbraun89]

I agree this kind of validation can be done only after DNS has fully resolved the url