Sanitize URL entry path, not just token, to prevent WebSocket crash

Author: bjorkert

LoopFollow/Controllers/Nightscout/NightscoutSocketManager.swift

@@ -40,10 +40,10 @@ class NightscoutSocketManager {
             return
         }
 
-        let url = Storage.shared.url.value
-        // Sanitize defensively: tokens saved before this fix may still hold a stray
+        // Sanitize defensively: values saved before this fix may still hold a stray
         // whitespace/control char that crashes Socket.IO's URL builder on iOS 26.
-        let token = NightscoutUtils.sanitizeToken(Storage.shared.token.value)
+        let url = NightscoutUtils.sanitizeConnectionInput(Storage.shared.url.value)
+        let token = NightscoutUtils.sanitizeConnectionInput(Storage.shared.token.value)
 
         guard !url.isEmpty else {
             disconnect()

LoopFollow/Helpers/NightscoutUtils.swift

@@ -163,9 +163,11 @@ class NightscoutUtils {
     }
 
     // Strip whitespace/newlines/control characters that can sneak in via paste.
-    // A raw one breaks WebSocket connect (invalid percent-encoded query traps on iOS 26).
-    static func sanitizeToken(_ token: String) -> String {
-        token.unicodeScalars
+    // Neither a URL nor a token may legally contain them, and a stray one breaks
+    // WebSocket connect (invalid percent-encoded query traps on iOS 26) or makes
+    // URL parsing fall back to a lossy cleanup that mangles the address.
+    static func sanitizeConnectionInput(_ input: String) -> String {
+        input.unicodeScalars
             .filter { !CharacterSet.whitespacesAndNewlines.contains($0) && !CharacterSet.controlCharacters.contains($0) }
             .map(String.init)
             .joined()

LoopFollow/Nightscout/NightscoutSettingsViewModel.swift

@@ -27,7 +27,7 @@ class NightscoutSettingsViewModel: ObservableObject {
     @Published var nightscoutToken: String = Storage.shared.token.value {
         willSet {
             if newValue != nightscoutToken {
-                Storage.shared.token.value = NightscoutUtils.sanitizeToken(newValue)
+                Storage.shared.token.value = NightscoutUtils.sanitizeConnectionInput(newValue)
                 triggerCheckStatus()
             }
         }
@@ -93,6 +93,12 @@ class NightscoutSettingsViewModel: ObservableObject {
     }
 
     func processURL(_ value: String) {
+        // Strip whitespace/newlines/control chars first. A URL can't legally contain
+        // them, and a stray one (e.g. a trailing newline from a paste) otherwise makes
+        // URLComponents parsing fail and falls through to the lossy fallback below,
+        // mangling a URL-with-embedded-token into an invalid address.
+        let value = NightscoutUtils.sanitizeConnectionInput(value)
+
         var useTokenUrl = false
 
         if let urlComponents = URLComponents(string: value), let queryItems = urlComponents.queryItems {