Function validateUrl

pkg/npm/install.js:35–39

(url)

// Security: only follow HTTPS URLs (defense-in-depth).
function validateUrl(url) {
  if (!url.startsWith('https://')) {
    throw new Error(`Refusing non-HTTPS URL: ${url}`);
  }
}

function download(url, dest) {
  validateUrl(url);