poprawka bledu

app.py

@@ -241,15 +241,28 @@ def cache_headers(etag: str, up_lm: Optional[str]):
 
 
 def validate_and_normalize_url(url):
+    url = (url or "").strip()
+
+    # prosta sanity-check: usuń CR/LF
+    if any(c in url for c in ("\r", "\n")):
+        raise ValueError("Invalid characters in URL")
+
     parsed = urlparse(url)
     if not parsed.scheme:
         url = f"https://{url}"
         parsed = urlparse(url)
+
+    # akceptuj tylko http/https
+    if parsed.scheme not in {"http", "https"}:
+        raise ValueError(f"Unsupported scheme: {parsed.scheme}")
+
     if not parsed.netloc:
         raise ValueError("Missing host in URL")
+
     return parsed.geturl()
 
 
+
 def track_url_request(url):
     redis_client.incr(f"stats:url_requests:{quote(url, safe='')}")