only try http(s) urls

src/widgets/feed/proxy.js

@@ -1,6 +1,6 @@
 import cache from "memory-cache";
 
-import { parseFeed } from "./utils";
+import { httpUrl, parseFeed } from "./utils";
 
 import getServiceWidget from "utils/config/service-helpers";
 import createLogger from "utils/logger";
@@ -18,12 +18,11 @@ export default async function feedProxyHandler(req, res) {
     return res.status(400).json({ error: "Missing feed URL" });
   }
 
-  let url;
+  const href = httpUrl(widget.url);
-  try {
+  if (!href) {
-    url = new URL(widget.url);
-  } catch {
     return res.status(400).json({ error: "Invalid feed URL" });
   }
+  const url = new URL(href);
 
   const cacheKey = `feed:${url.href}`;
   let items = cache.get(cacheKey);

src/widgets/feed/proxy.test.js

@@ -52,6 +52,12 @@ describe("widgets/feed/proxy", () => {
     await feedProxyHandler(req, res);
     expect(res.statusCode).toBe(400);
     expect(res.body).toEqual({ error: "Invalid feed URL" });
+
+    getServiceWidget.mockResolvedValueOnce({ type: "feed", url: "file:///etc/passwd" });
+    res = createMockRes();
+    await feedProxyHandler(req, res);
+    expect(res.statusCode).toBe(400);
+    expect(res.body).toEqual({ error: "Invalid feed URL" });
     expect(httpProxy).not.toHaveBeenCalled();
   });