From e41d24b45dc13dbbcb9ebb1d21495492cab2a563 Mon Sep 17 00:00:00 2001
From: Joseph Shenton <134051803+moderniselife@users.noreply.github.com>
Date: Thu, 24 Sep 2026 17:20:56 +1000
Subject: [PATCH] Potential fix for code scanning alert no. 12: Server-side
 request forgery

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 src/providers/registry.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/providers/registry.ts b/src/providers/registry.ts
index 163dc5a..e709b44 100644
--- a/src/providers/registry.ts
+++ b/src/providers/registry.ts
@@ -240,9 +240,11 @@ class ProviderRegistry {
     let fileBuffer: Buffer;
     try {
       assertPublicHttpUrl(torrentUrl);
-      const resp = await axios.get(torrentUrl, {
+      const safeUrl = new URL(torrentUrl).toString();
+      const resp = await axios.get(safeUrl, {
         responseType: 'arraybuffer',
         timeout: 30000,
+        maxRedirects: 0,
         httpAgent: new http.Agent({ family: 4 }),
         httpsAgent: new https.Agent({ family: 4 }),
       });