From 7338461efe49e219a3bcd4463095f6abdc7dc333 Mon Sep 17 00:00:00 2001
From: Jiho Andrew Lee <search5@gmail.com>
Date: Mon, 7 Sep 2026 17:36:45 +0900
Subject: [PATCH] Update core/podcasts/podcasts.go

Co-authored-by: strix-security[bot] <257889806+strix-security[bot]@users.noreply.github.com>
---
 core/podcasts/podcasts.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/core/podcasts/podcasts.go b/core/podcasts/podcasts.go
index cec853d03..8714c5d2d 100644
--- a/core/podcasts/podcasts.go
+++ b/core/podcasts/podcasts.go
@@ -312,6 +312,10 @@ func (s *podcastService) doDownload(ctx context.Context, ep *model.PodcastEpisod
 	}
 	defer f.Close()
 
+	if err := validateURL(ep.EnclosureURL); err != nil {
+		s.setEpisodeError(ctx, ep, fmt.Errorf("invalid enclosure URL: %w", err))
+		return
+	}
 	httpClient := &http.Client{Timeout: 30 * time.Second}
 	resp, err := httpClient.Get(ep.EnclosureURL) //nolint:gosec
 	if err != nil {