fix(plugin): don't cache error responses, add SSRF guard to plugin_get

plugins/decky-vault/main.py

@@ -849,6 +849,9 @@ exec mangohud "$@"
         import urllib.request
         import urllib.error
         try:
+            # SSRF guard: only allow http/https schemes
+            if not base_url.startswith(("http://", "https://")):
+                return {"error": "Invalid base_url scheme", "status": 0}
             if not path.startswith("/"):
                 path = "/" + path
             url = f"{base_url}/api{path}"

plugins/decky-vault/src/lib/plugin-api.ts

@@ -56,7 +56,10 @@ export async function fetchPluginGame(
   const path = `/plugin/game/${steamAppId}?limit=${limit}${hardware ? `&hardware=${encodeURIComponent(hardware)}` : ""}`
   const raw = await pluginGet(path, settingsRef.baseUrl)
   const value = raw as unknown as PluginGameResponse
+  // Don't cache error responses — transient failures shouldn't poison the cache
+  if (!raw.error) {
     cache.set(key, { value, expires: Date.now() + TTL_MS })
+  }
   return value
 }