validateURLScheme rejects non-https URLs before any fetch (defense-in-depth).
(rawURL string)
| 175 | |
| 176 | // validateURLScheme rejects non-https URLs before any fetch (defense-in-depth). |
| 177 | func validateURLScheme(rawURL string) error { |
| 178 | if !strings.HasPrefix(rawURL, "https://") { |
| 179 | return fmt.Errorf("refusing non-https URL: %s", rawURL) |
| 180 | } |
| 181 | return nil |
| 182 | } |
| 183 | |
| 184 | // httpsOnlyClient returns an HTTP client that rejects non-HTTPS redirects. |
| 185 | var httpsOnlyClient = &http.Client{ |
no outgoing calls
no test coverage detected