Function validateWebsiteURL

internal/validators/validators.go:153–213

(ctx *ValidationContext, websiteURL string)

}

func validateWebsiteURL(ctx *ValidationContext, websiteURL string) *ValidationResult {
	result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}}

	// Skip validation if website URL is not provided (optional field)
	if websiteURL == "" {
		return result
	}

	// Parse the URL to ensure it's valid
	parsedURL, err := url.Parse(websiteURL)
	if err != nil {
		issue := NewValidationIssueFromError(
			ValidationIssueTypeSemantic,
			ctx.String(),
			fmt.Errorf("invalid websiteUrl: %w", err),
			"invalid-website-url",
		)
		result.AddIssue(issue)
		return result
	}

	// Ensure it's an absolute URL with valid scheme
	if !parsedURL.IsAbs() {
		issue := NewValidationIssue(
			ValidationIssueTypeSemantic,
			ctx.String(),
			fmt.Sprintf("websiteUrl must be absolute (include scheme): %s", websiteURL),
			ValidationIssueSeverityError,
			"website-url-must-be-absolute",
		)
		result.AddIssue(issue)
	}

	// Only allow HTTPS scheme for security
	if parsedURL.Scheme != SchemeHTTPS {
		issue := NewValidationIssue(
			ValidationIssueTypeSemantic,
			ctx.String(),
			fmt.Sprintf("websiteUrl must use https scheme: %s", websiteURL),
			ValidationIssueSeverityError,
			"website-url-invalid-scheme",
		)
		result.AddIssue(issue)
	}

	// Reject characters that aren't valid in a URI per RFC 3986 and that have
	// caused rendering issues when websiteUrl flows into the catalogue UI's
	// href attributes. Publishers should percent-encode these in the source URL.
	if i := strings.IndexAny(websiteURL, "\"'<> \t\n\r"); i >= 0 {
		issue := NewValidationIssue(
			ValidationIssueTypeSemantic,
			ctx.String(),
			fmt.Sprintf("websiteUrl contains an invalid character %q at position %d: %s", websiteURL[i], i, websiteURL),
			ValidationIssueSeverityError,
			"website-url-invalid-characters",
		)
		result.AddIssue(issue)
	}