net: block private and link-local URLs

1 files changed, 6 insertions, 0 deletions

diff --git a/src/tasks/mod.rs b/src/tasks/mod.rs
index 362db80..c895a1b 100644
--- a/src/tasks/mod.rs
+++ b/src/tasks/mod.rs
@@ -122,6 +122,12 @@ async fn execute_audio_job(ctx: &CronContext, job: &crate::database::CronJob) {
     // job may point at an arbitrary third-party URL and must never receive
     // the password.
     let url = ctx.copyparty.build_url_for(audio_url);
+    if !ctx.copyparty.is_own_url(&url)
+        && let Err(e) = crate::net::ensure_public_http_url(&url).await
+    {
+        error!("Cron audio job {} refused URL: {e}", job.id);
+        return;
+    }
     info!(
         "Cron audio job {} playing: {}",
         job.id,