net: block private and link-local URLs

1 files changed, 4 insertions, 0 deletions

diff --git a/src/commands/music.rs b/src/commands/music.rs
index 245eb88..baa91b1 100644
--- a/src/commands/music.rs
+++ b/src/commands/music.rs
@@ -121,6 +121,10 @@ async fn resolve_source(
         let url = name.clone();
         let display_name = clean_name(url.rsplit('/').next().unwrap_or(&url));
 
+        if !ctx.data().copyparty.is_own_url(&url) {
+            crate::net::ensure_public_http_url(&url).await?;
+        }
+
         // yt-dlp platforms → download; everything else (radio, HLS,
         // playlists, Copyparty, direct media) → ffmpeg stream.
         let kind = classify_url(&url);