From 9eb25311c842062e54a34ad163ea27b96d74bf00 Mon Sep 17 00:00:00 2001
From: kami <kami@homesrv>
Date: Wed, 15 Jul 2026 11:38:09 +0400
Subject: [PATCH] update PLANS.md with ssrf and re-enrich sections

---
 PLANS.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/PLANS.md b/PLANS.md
index 3ac4a56..8bd2c70 100644
--- a/PLANS.md
+++ b/PLANS.md
@@ -18,3 +18,17 @@ fix: single query with `WHERE t.album_id = ANY($1::uuid[])` — already batched
 
 ### verification
 `comfortGenerator` and `deepDiveGenerator` are tested in `generators.test.ts`
+
+## 2. SSRF guard (images.routes.ts)
+
+current: only checks `url.startsWith('http://') || url.startsWith('https://')` — trivial bypass
+fix: add domain allowlist of known image hosts, validate after redirect
+
+allowed domains:
+- coverartarchive.org + *.coverartarchive.org
+- lastfm.freetls.fastly.net
+- i.scdn.co (spotify)
+- images.genius.com
+- *.musicbrainz.org
+- commons.wikimedia.org
+- e.snmc.io