From 4b2b4af606237def78273a42e881ae9f971cb505 Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Wed, 4 Nov 2026 01:29:57 +0100
Subject: net: block private and link-local URLs

---
 src/commands/utilities.rs | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'src/commands/utilities.rs')

diff --git a/src/commands/utilities.rs b/src/commands/utilities.rs
index c26fd0e..7a2e65d 100644
--- a/src/commands/utilities.rs
+++ b/src/commands/utilities.rs
@@ -496,6 +496,11 @@ async fn run_download(
     fformat: Option<&str>,
     filename_user: Option<&str>,
 ) -> Result<()> {
+    // Copyparty may legitimately live on localhost/LAN; every other host must
+    // be public. This blocks metadata endpoints and internal services.
+    if !ctx.data().copyparty.is_own_url(url) {
+        crate::net::ensure_public_http_url(url).await?;
+    }
     let fmt = fformat.unwrap_or("mp4");
     let is_audio = matches!(fmt, "mp3" | "wav" | "m4a");
     let dl_dir = format!("{}/dl_{}", crate::config::TEMP_PATH, uuid::Uuid::new_v4());
-- 
cgit v1.2.3