net: block private and link-local URLs

3 files changed, 12 insertions, 0 deletions

diff --git a/src/commands/cron.rs b/src/commands/cron.rs
index ebaa96d..301ae3d 100644
--- a/src/commands/cron.rs
+++ b/src/commands/cron.rs
@@ -45,6 +45,9 @@ pub async fn dodaj_audio(
     };
 
     let guild_id = ctx.guild_id().ok_or_else(lang::err_not_in_guild)?;
+    if !ctx.data().copyparty.is_own_url(&full_url) {
+        crate::net::ensure_public_http_url(&full_url).await?;
+    }
     database::add_cron_job(
         &ctx.data().db_pool,
         guild_id.get() as i64,
diff --git a/src/commands/music.rs b/src/commands/music.rs
index 245eb88..baa91b1 100644
--- a/src/commands/music.rs
+++ b/src/commands/music.rs
@@ -121,6 +121,10 @@ async fn resolve_source(
         let url = name.clone();
         let display_name = clean_name(url.rsplit('/').next().unwrap_or(&url));
 
+        if !ctx.data().copyparty.is_own_url(&url) {
+            crate::net::ensure_public_http_url(&url).await?;
+        }
+
         // yt-dlp platforms → download; everything else (radio, HLS,
         // playlists, Copyparty, direct media) → ffmpeg stream.
         let kind = classify_url(&url);
diff --git a/src/commands/utilities.rs b/src/commands/utilities.rs
index c26fd0e..7a2e65d 100644
--- a/src/commands/utilities.rs
+++ b/src/commands/utilities.rs
@@ -496,6 +496,11 @@ async fn run_download(
     fformat: Option<&str>,
     filename_user: Option<&str>,
 ) -> Result<()> {
+    // Copyparty may legitimately live on localhost/LAN; every other host must
+    // be public. This blocks metadata endpoints and internal services.
+    if !ctx.data().copyparty.is_own_url(url) {
+        crate::net::ensure_public_http_url(url).await?;
+    }
     let fmt = fformat.unwrap_or("mp4");
     let is_audio = matches!(fmt, "mp3" | "wav" | "m4a");
     let dl_dir = format!("{}/dl_{}", crate::config::TEMP_PATH, uuid::Uuid::new_v4());