poprawka bledu

app.py

@@ -241,15 +241,28 @@ def cache_headers(etag: str, up_lm: Optional[str]):
 
 
 def validate_and_normalize_url(url):
+    url = (url or "").strip()
+
+    # prosta sanity-check: usuń CR/LF
+    if any(c in url for c in ("\r", "\n")):
+        raise ValueError("Invalid characters in URL")
+
     parsed = urlparse(url)
     if not parsed.scheme:
         url = f"https://{url}"
         parsed = urlparse(url)
+
+    # akceptuj tylko http/https
+    if parsed.scheme not in {"http", "https"}:
+        raise ValueError(f"Unsupported scheme: {parsed.scheme}")
+
     if not parsed.netloc:
         raise ValueError("Missing host in URL")
+
     return parsed.geturl()
 
 
+
 def track_url_request(url):
     redis_client.incr(f"stats:url_requests:{quote(url, safe='')}")
 

listapp.service

@@ -6,14 +6,11 @@ Wants=network-online.target
 [Service]
 User=www-data
 Group=www-data
-
-# główny katalog aplikacji
-Environment="APP_DIR=/var/www/adlist_mikrotik"
 WorkingDirectory=/var/www/adlist_mikrotik
 EnvironmentFile=-/var/www/adlist_mikrotik/.env
-Environment="PATH=${APP_DIR}/venv/bin"
+Environment="PATH=/var/www/adlist_mikrotik/venv/bin"
 
-ExecStart=${APP_DIR}/venv/bin/gunicorn \
+ExecStart=/var/www/adlist_mikrotik/venv/bin/gunicorn \
   -k uvicorn.workers.UvicornWorker \
   --workers 4 \
   --bind 127.0.0.1:8283 \