From 8c241780eb74662c57955378b21fd6686cfa43e2 Mon Sep 17 00:00:00 2001
From: aandrew-me <aandrew.me@proton.me>
Date: Tue, 16 Jun 2026 18:15:53 +0300
Subject: [PATCH] Add url validation

---
 src/playlist.js | 20 ++++++++++++++++++--
 src/renderer.js | 33 +++++++++++++++++++++++++++++++--
 2 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/src/playlist.js b/src/playlist.js
index c30861f..ff68675 100644
--- a/src/playlist.js
+++ b/src/playlist.js
@@ -214,10 +214,14 @@ const playlistDownloader = {
 	},
 
 	startDownload(type) {
-		if (!this.state.url) {
-			this.showError("URL is missing. Please paste a link first.");
+		try {
+			this.state.url = this.validateUrl(this.state.url);
+		} catch (_) {
+			this.showError("Invalid URL");
+
 			return;
 		}
+
 		this.updateDynamicConfig();
 		this.hideOptions();
 
@@ -712,6 +716,18 @@ const playlistDownloader = {
 			}
 		}
 	},
+	validateUrl(rawUrl) {
+		const input = String(rawUrl ?? "").trim();
+
+		let parsed;
+		try {
+			parsed = new URL(input);
+		} catch {
+			throw new Error("invalidUrl");
+		}
+
+		return parsed.toString();
+	}
 };
 
 playlistDownloader.init();
diff --git a/src/renderer.js b/src/renderer.js
index f1b5cd6..82a63ad 100644
--- a/src/renderer.js
+++ b/src/renderer.js
@@ -855,13 +855,23 @@ class YtDownloaderApp {
 	 * @param {string} url The video URL.
 	 */
 	async getInfo(url) {
+		let safeUrl;
+		try {
+			safeUrl = this.validateUrl(url);
+		} catch {
+			this._showError(i18n.__("invalidUrl"), url);
+
+			return;
+		}
+
 		this._loadSettings();
 		this._defaultVideoToggle();
 		this._resetUIForNewLink();
-		this.state.videoInfo.url = url;
+
+		this.state.videoInfo.url = safeUrl;
 
 		try {
-			const metadata = await this._fetchVideoMetadata(url);
+			const metadata = await this._fetchVideoMetadata(safeUrl);
 			console.log(metadata);
 
 			const durationInt =
@@ -2157,6 +2167,25 @@ class YtDownloaderApp {
 
 		this._updateSliderUI(null);
 	}
+
+	/**
+	 * Validates a URL and returns the sanitized version.
+	 * @param {string} rawUrl - The URL to validate.
+	 * @returns {string} - The sanitized URL.
+	 * @throws {Error} - If the URL is invalid.
+	 */
+	validateUrl(rawUrl) {
+		const input = String(rawUrl ?? "").trim();
+
+		let parsed;
+		try {
+			parsed = new URL(input);
+		} catch {
+			throw new Error("invalidUrl");
+		}
+
+		return parsed.toString();
+	}
 }
 
 // --- Application Entry Point ---