From ed04b87f16c1048ca49d59e736b9af0632fab2eb Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Mon, 13 Jul 2026 05:13:01 +0800
Subject: [PATCH] fix(plugin): don't cache error responses, add SSRF guard to
 plugin_get

---
 plugins/decky-vault/main.py               | 3 +++
 plugins/decky-vault/src/lib/plugin-api.ts | 5 ++++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/plugins/decky-vault/main.py b/plugins/decky-vault/main.py
index da81ac0..83eebc9 100644
--- a/plugins/decky-vault/main.py
+++ b/plugins/decky-vault/main.py
@@ -849,6 +849,9 @@ exec mangohud "$@"
         import urllib.request
         import urllib.error
         try:
+            # SSRF guard: only allow http/https schemes
+            if not base_url.startswith(("http://", "https://")):
+                return {"error": "Invalid base_url scheme", "status": 0}
             if not path.startswith("/"):
                 path = "/" + path
             url = f"{base_url}/api{path}"
diff --git a/plugins/decky-vault/src/lib/plugin-api.ts b/plugins/decky-vault/src/lib/plugin-api.ts
index 07bcc2b..3ddd9ed 100644
--- a/plugins/decky-vault/src/lib/plugin-api.ts
+++ b/plugins/decky-vault/src/lib/plugin-api.ts
@@ -56,7 +56,10 @@ export async function fetchPluginGame(
   const path = `/plugin/game/${steamAppId}?limit=${limit}${hardware ? `&hardware=${encodeURIComponent(hardware)}` : ""}`
   const raw = await pluginGet(path, settingsRef.baseUrl)
   const value = raw as unknown as PluginGameResponse
-  cache.set(key, { value, expires: Date.now() + TTL_MS })
+  // Don't cache error responses — transient failures shouldn't poison the cache
+  if (!raw.error) {
+    cache.set(key, { value, expires: Date.now() + TTL_MS })
+  }
   return value
 }