fix(onebot): tighten inbound media download handling

pkg/utils/http_guard_test.go

@@ -60,7 +60,10 @@ func TestCreateSafeHTTPClient_BlocksPrivateRedirect(t *testing.T) {
 	}
 
 	allowPrivateHosts = false
-	_, err = client.Get(server.URL)
+	resp, err := client.Get(server.URL)
+	if resp != nil && resp.Body != nil {
+		resp.Body.Close()
+	}
 	if err == nil {
 		t.Fatal("expected redirect to private host to fail")
 	}

pkg/utils/media.go

@@ -97,9 +97,10 @@ func DownloadFile(urlStr, filename string, opts DownloadOptions) string {
 	var client *http.Client
 	var err error
 	if opts.BlockPrivateTargets {
-		if err := ValidateSafeHTTPURL(urlStr, nil, nil); err != nil {
+		validateErr := ValidateSafeHTTPURL(urlStr, nil, nil)
+		if validateErr != nil {
 			logger.ErrorCF(opts.LoggerPrefix, "Blocked unsafe download URL", map[string]any{
-				"error": err.Error(),
+				"error": validateErr.Error(),
 				"url":   urlStr,
 			})
 			return ""