fix: prevent loopback Run release URLs

platform/service/distributions.go

@@ -6,6 +6,8 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"net"
+	"net/url"
 	"os"
 	"strings"
 
@@ -48,6 +50,9 @@ func (svc *CoreService) GenerateRunDistributionForSession(sessionID string, requ
 	if ready, reason := svc.distributionBuilderReadiness(); !ready {
 		return domain.RunDistribution{}, validationError(reason)
 	}
+	if _, err := runReleasePlatformURL(); err != nil {
+		return domain.RunDistribution{}, err
+	}
 
 	key, _, err := svc.ensureActiveComponentKey(instance.ID, domain.DistributionComponentRun, "")
 	if err != nil {
@@ -778,11 +783,28 @@ func packageFormatForTarget(targetOS string) string {
 	return "tar.gz"
 }
 
-func runReleasePlatformURL() string {
-	if value := strings.TrimSpace(os.Getenv("PLATFORM_RUN_RELEASE_URL")); value != "" {
-		return value
+const defaultRunReleasePlatformURL = "https://scum.npc0.com/"
+
+func runReleasePlatformURL() (string, error) {
+	value := strings.TrimSpace(os.Getenv("PLATFORM_RUN_RELEASE_URL"))
+	if value == "" {
+		value = defaultRunReleasePlatformURL
 	}
-	return "http://127.0.0.1:8080/"
+	parsed, err := url.ParseRequestURI(value)
+	if err != nil || (parsed.Scheme != "http" && parsed.Scheme != "https") || parsed.Host == "" || parsed.User != nil || parsed.RawQuery != "" || parsed.ForceQuery || parsed.Fragment != "" || strings.Contains(value, "#") {
+		return "", validationError("PLATFORM_RUN_RELEASE_URL must be an absolute http or https URL without credentials, query parameters, or fragments")
+	}
+	host := strings.TrimRight(strings.ToLower(parsed.Hostname()), ".")
+	if host == "" {
+		return "", validationError("PLATFORM_RUN_RELEASE_URL must be an absolute http or https URL with a host")
+	}
+	if host == "localhost" || strings.HasSuffix(host, ".localhost") {
+		return "", validationError("PLATFORM_RUN_RELEASE_URL must use an address reachable from the target server; loopback or unspecified addresses are not valid for generated Run packages")
+	}
+	if ip := net.ParseIP(host); ip != nil && (ip.IsLoopback() || ip.IsUnspecified()) {
+		return "", validationError("PLATFORM_RUN_RELEASE_URL must use an address reachable from the target server; loopback or unspecified addresses are not valid for generated Run packages")
+	}
+	return value, nil
 }
 
 func distributionID(prefix string, parts ...interface{}) string {