From e66e53c5dd4651605b1a0b13d350b669a1d7b95f Mon Sep 17 00:00:00 2001
From: Jiho Andrew Lee <search5@gmail.com>
Date: Mon, 7 Sep 2026 17:36:29 +0900
Subject: [PATCH] Update core/podcasts/podcasts.go

Co-authored-by: strix-security[bot] <257889806+strix-security[bot]@users.noreply.github.com>
---
 core/podcasts/podcasts.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/podcasts/podcasts.go b/core/podcasts/podcasts.go
index 0782fcbc9..cec853d03 100644
--- a/core/podcasts/podcasts.go
+++ b/core/podcasts/podcasts.go
@@ -532,6 +532,9 @@ func (pw *progressWriter) Write(p []byte) (int, error) {
 }
 
 func fetchAndParse(rssURL string) (*rssFeed, error) {
+	if err := validateURL(rssURL); err != nil {
+		return nil, fmt.Errorf("invalid RSS feed URL: %w", err)
+	}
 	httpClient := &http.Client{Timeout: 15 * time.Second}
 	resp, err := httpClient.Get(rssURL) //nolint:gosec
 	if err != nil {