From 00875123f598e7baecc32f76508a7c898ac1c096 Mon Sep 17 00:00:00 2001
From: Julian Lechner <fraujulian@lechner.top>
Date: Mon, 28 Sep 2026 13:36:44 +0200
Subject: [PATCH] fix(security): restrict audio URLs to HTTP(S)

---
 src/audio-manager.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/audio-manager.ts b/src/audio-manager.ts
index fe6f5ef..5c87bb4 100644
--- a/src/audio-manager.ts
+++ b/src/audio-manager.ts
@@ -307,8 +307,13 @@ export default class AudioManager implements Disposable {
 
         if (this.audioSource.type === 'url') {
             try {
+                const url = new URL(this.audioSource.url);
+                if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+                    throw new Error('Unsupported audio source protocol.');
+                }
+
                 return {
-                    input: new URL(this.audioSource.url).toString(),
+                    input: url.toString(),
                     source: this.audioSource,
                 };
             } catch (error) {