From 4b2b4af606237def78273a42e881ae9f971cb505 Mon Sep 17 00:00:00 2001 From: salmonik Date: Wed, 4 Nov 2026 01:29:57 +0100 Subject: net: block private and link-local URLs --- src/commands/cron.rs | 3 +++ src/commands/music.rs | 4 ++++ src/commands/utilities.rs | 5 +++++ 3 files changed, 12 insertions(+) (limited to 'src/commands') diff --git a/src/commands/cron.rs b/src/commands/cron.rs index ebaa96d..301ae3d 100644 --- a/src/commands/cron.rs +++ b/src/commands/cron.rs @@ -45,6 +45,9 @@ pub async fn dodaj_audio( }; let guild_id = ctx.guild_id().ok_or_else(lang::err_not_in_guild)?; + if !ctx.data().copyparty.is_own_url(&full_url) { + crate::net::ensure_public_http_url(&full_url).await?; + } database::add_cron_job( &ctx.data().db_pool, guild_id.get() as i64, diff --git a/src/commands/music.rs b/src/commands/music.rs index 245eb88..baa91b1 100644 --- a/src/commands/music.rs +++ b/src/commands/music.rs @@ -121,6 +121,10 @@ async fn resolve_source( let url = name.clone(); let display_name = clean_name(url.rsplit('/').next().unwrap_or(&url)); + if !ctx.data().copyparty.is_own_url(&url) { + crate::net::ensure_public_http_url(&url).await?; + } + // yt-dlp platforms → download; everything else (radio, HLS, // playlists, Copyparty, direct media) → ffmpeg stream. let kind = classify_url(&url); diff --git a/src/commands/utilities.rs b/src/commands/utilities.rs index c26fd0e..7a2e65d 100644 --- a/src/commands/utilities.rs +++ b/src/commands/utilities.rs @@ -496,6 +496,11 @@ async fn run_download( fformat: Option<&str>, filename_user: Option<&str>, ) -> Result<()> { + // Copyparty may legitimately live on localhost/LAN; every other host must + // be public. This blocks metadata endpoints and internal services. + if !ctx.data().copyparty.is_own_url(url) { + crate::net::ensure_public_http_url(url).await?; + } let fmt = fformat.unwrap_or("mp4"); let is_audio = matches!(fmt, "mp3" | "wav" | "m4a"); let dl_dir = format!("{}/dl_{}", crate::config::TEMP_PATH, uuid::Uuid::new_v4()); -- cgit v1.2.3