net: block private and link-local URLs

1 files changed, 5 insertions, 0 deletions

diff --git a/src/commands/utilities.rs b/src/commands/utilities.rs
index c26fd0e..7a2e65d 100644
--- a/src/commands/utilities.rs
+++ b/src/commands/utilities.rs
@@ -496,6 +496,11 @@ async fn run_download(
     fformat: Option<&str>,
     filename_user: Option<&str>,
 ) -> Result<()> {
+    // Copyparty may legitimately live on localhost/LAN; every other host must
+    // be public. This blocks metadata endpoints and internal services.
+    if !ctx.data().copyparty.is_own_url(url) {
+        crate::net::ensure_public_http_url(url).await?;
+    }
     let fmt = fformat.unwrap_or("mp4");
     let is_audio = matches!(fmt, "mp3" | "wav" | "m4a");
     let dl_dir = format!("{}/dl_{}", crate::config::TEMP_PATH, uuid::Uuid::new_v4());