fix(validator): restrict to allow only HTTP protocol

internal/utils/validator.go

@@ -1,11 +1,26 @@
 package utils
 
-import "github.com/asaskevich/govalidator"
+import (
+	"net/url"
+
+	"github.com/asaskevich/govalidator"
+)
 
 func ValidateEmail(email string) bool {
 	return govalidator.IsEmail(email)
 }
 
-func ValidateURL(url string) bool {
-	return govalidator.IsRequestURL(url)
+func ValidateURL(v string) bool {
+	u, err := url.ParseRequestURI(v)
+	if err != nil {
+		return false
+	}
+	if len(u.Scheme) == 0 {
+		return false
+	}
+	// Must https or http
+	if u.Scheme != "https" && u.Scheme != "http" {
+		return false
+	}
+	return true
 }

internal/utils/validator_test.go

@@ -29,7 +29,8 @@ func TestValidateURL(t *testing.T) {
 	}{
 		{"https://example.com", true},
 		{"invalid.url", false},
-		{"https://example.com/path?param=value", true},
+		{"http://example.com/path?param=value", true},
+		{"ftp://example.com", false},
 	}
 
 	for _, tc := range testCases {