From fa33ea8faad4ae622f36f1d52a9b08b6fa4c6d0d Mon Sep 17 00:00:00 2001
From: Codex Microtask Operator <codex-microtask@example.com>
Date: Sat, 13 Jun 2026 01:51:39 +0200
Subject: [PATCH] Ignore malformed feed probe candidates

---
 .../feed-discovery/src/feed-discovery.test.ts  | 18 ++++++++++++++++++
 .../src/providers/web-feed-probe.ts            |  2 +-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/plugins/feed-discovery/src/feed-discovery.test.ts b/plugins/feed-discovery/src/feed-discovery.test.ts
index f2c4383..2c229e9 100644
--- a/plugins/feed-discovery/src/feed-discovery.test.ts
+++ b/plugins/feed-discovery/src/feed-discovery.test.ts
@@ -3,6 +3,7 @@ import { dedupeFeeds } from "./dedupe.js";
 import { discoverFeeds } from "./discovery.js";
 import { parseFeedDocument } from "./feed-parsing.js";
 import { renderDiscoveryOutput } from "./output/index.js";
+import { WebCandidateFeedProbeProvider } from "./providers/web-feed-probe.js";
 import { extractAlternateFeedLinks } from "./probe-site.js";
 import { scoreFeed } from "./scoring.js";
 import type { DiscoveredFeed, FeedDiscoveryProvider } from "./types.js";
@@ -54,6 +55,23 @@ describe("site probing helpers", () => {
     await expect(assertSafeHttpUrl("http://[::ffff:192.168.1.10]/feed")).rejects.toThrow(/Blocked internal/);
     await expect(assertSafeHttpUrl("file:///etc/passwd")).rejects.toThrow(/Unsupported URL protocol/);
   });
+
+  it("ignores malformed configured candidate URLs", async () => {
+    const provider = new WebCandidateFeedProbeProvider({
+      cacheTtlSeconds: 60,
+      maxProviders: 1,
+      maxProbes: 1,
+      requestTimeoutMs: 10,
+      maxBodyBytes: 1024,
+      userAgent: "test",
+      opmlPaths: [],
+      candidateUrls: ["not-a-url|micro"],
+      podcastIndexApiKey: undefined,
+      podcastIndexApiSecret: undefined
+    });
+
+    await expect(provider.search({ q: "micro" })).resolves.toEqual([]);
+  });
 });
 
 describe("scoring, dedupe, and output", () => {
diff --git a/plugins/feed-discovery/src/providers/web-feed-probe.ts b/plugins/feed-discovery/src/providers/web-feed-probe.ts
index 16d27ef..cbe1583 100644
--- a/plugins/feed-discovery/src/providers/web-feed-probe.ts
+++ b/plugins/feed-discovery/src/providers/web-feed-probe.ts
@@ -30,7 +30,7 @@ function candidateUrls(query: FeedDiscoveryQuery, configured: string[]) {
 
   for (const entry of configured) {
     const [url, ...keywords] = entry.split("|").map((part) => part.trim());
-    if (!url) {
+    if (!/^https?:\/\//i.test(url)) {
       continue;
     }
     if (keywords.length === 0 || keywords.some((keyword) => query.q.toLowerCase().includes(keyword.toLowerCase()))) {