fix(komide): validate_url uses url::Url parse (closes #203)

Cargo.toml

@@ -146,6 +146,9 @@ nzb-rs          = "0.6"
 # ── Feeds ──────────────────────────────────────────────────────────────────────
 feed-rs         = "2.3"
 
+# ── URL parsing ───────────────────────────────────────────────────────────────
+url             = "2.5"
+
 # ── CLI ───────────────────────────────────────────────────────────────────────
 clap            = { version = "4", features = ["derive"] }
 

crates/komide/Cargo.toml

@@ -14,6 +14,7 @@ tokio           = { workspace = true }
 feed-rs         = { workspace = true }
 reqwest         = { workspace = true }
 serde           = { workspace = true }
+url             = { workspace = true }
 uuid            = { workspace = true }
 jiff            = { workspace = true }
 

crates/komide/src/service/mod.rs

@@ -572,14 +572,20 @@ impl KomideService {
     }
 }
 
-fn validate_url(url: &str) -> Result<(), KomideError> {
-    if url.is_empty() || (!url.starts_with("http://") && !url.starts_with("https://")) {
-        return InvalidUrlSnafu {
-            url: url.to_string(),
+fn validate_url(input: &str) -> Result<(), KomideError> {
+    let parsed = url::Url::parse(input).map_err(|_| {
+        InvalidUrlSnafu {
+            url: input.to_string(),
+        }
+        .build()
+    })?;
+    match parsed.scheme() {
+        "http" | "https" if parsed.has_host() => Ok(()),
+        _ => InvalidUrlSnafu {
+            url: input.to_string(),
         }
-        .fail();
+        .fail(),
     }
-    Ok(())
 }
 
 async fn fetch_bytes(client: &reqwest::Client, url: &str) -> Result<Vec<u8>, KomideError> {

crates/komide/src/service/tests.rs

@@ -39,6 +39,44 @@ async fn validate_url_accepts_http() {
     assert!(validate_url("http://example.com/feed.xml").is_ok());
 }
 
+#[tokio::test]
+async fn validate_url_accepts_loopback_with_port() {
+    assert!(validate_url("http://127.0.0.1:7878").is_ok());
+}
+
+#[tokio::test]
+async fn validate_url_accepts_lan_host() {
+    assert!(validate_url("http://kanon.lan").is_ok());
+}
+
+#[tokio::test]
+async fn validate_url_rejects_javascript_scheme() {
+    assert!(validate_url("javascript:alert(1)").is_err());
+}
+
+#[tokio::test]
+async fn validate_url_rejects_unparseable() {
+    assert!(validate_url("not a url").is_err());
+}
+
+#[tokio::test]
+async fn validate_url_rejects_scheme_relative() {
+    // old prefix-match would accept this as invalid; url::Url rejects it outright
+    assert!(validate_url("//no-scheme.com").is_err());
+}
+
+#[tokio::test]
+async fn validate_url_rejects_http_without_host() {
+    // old prefix-match silently accepted "http://"; url::Url parses but has no host
+    assert!(validate_url("http://").is_err());
+}
+
+#[tokio::test]
+async fn validate_url_rejects_https_colon_only() {
+    // old prefix-match rejected; new parse rejects too (no host)
+    assert!(validate_url("https:").is_err());
+}
+
 #[tokio::test]
 async fn list_feeds_empty_returns_empty() {
     let (svc, _rx) = setup().await;