From 4b8c5a91e75682860548b66be6f65ee811b15f80 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Thu, 24 Sep 2026 16:33:56 -0700
Subject: [PATCH] only try http(s) urls

---
 src/widgets/feed/proxy.js      | 9 ++++-----
 src/widgets/feed/proxy.test.js | 6 ++++++
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/widgets/feed/proxy.js b/src/widgets/feed/proxy.js
index 7f58460c3..de54f645f 100644
--- a/src/widgets/feed/proxy.js
+++ b/src/widgets/feed/proxy.js
@@ -1,6 +1,6 @@
 import cache from "memory-cache";
 
-import { parseFeed } from "./utils";
+import { httpUrl, parseFeed } from "./utils";
 
 import getServiceWidget from "utils/config/service-helpers";
 import createLogger from "utils/logger";
@@ -18,12 +18,11 @@ export default async function feedProxyHandler(req, res) {
     return res.status(400).json({ error: "Missing feed URL" });
   }
 
-  let url;
-  try {
-    url = new URL(widget.url);
-  } catch {
+  const href = httpUrl(widget.url);
+  if (!href) {
     return res.status(400).json({ error: "Invalid feed URL" });
   }
+  const url = new URL(href);
 
   const cacheKey = `feed:${url.href}`;
   let items = cache.get(cacheKey);
diff --git a/src/widgets/feed/proxy.test.js b/src/widgets/feed/proxy.test.js
index f713ea835..3c86ef70c 100644
--- a/src/widgets/feed/proxy.test.js
+++ b/src/widgets/feed/proxy.test.js
@@ -52,6 +52,12 @@ describe("widgets/feed/proxy", () => {
     await feedProxyHandler(req, res);
     expect(res.statusCode).toBe(400);
     expect(res.body).toEqual({ error: "Invalid feed URL" });
+
+    getServiceWidget.mockResolvedValueOnce({ type: "feed", url: "file:///etc/passwd" });
+    res = createMockRes();
+    await feedProxyHandler(req, res);
+    expect(res.statusCode).toBe(400);
+    expect(res.body).toEqual({ error: "Invalid feed URL" });
     expect(httpProxy).not.toHaveBeenCalled();
   });