From 6bcf0860a3841865099d0115dbcbde8b78109bd9 Mon Sep 17 00:00:00 2001
From: isaacs <i@izs.me>
Date: Thu, 27 Feb 2020 16:49:16 -0800
Subject: [PATCH] fix: treat non-http/https login urls as invalid

---
 lib/index.js      | 2 +-
 lib/test/login.js | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/index.js b/lib/index.js
index abfb294..d9c48c1 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -23,7 +23,7 @@ const url = require('url')
 const isValidUrl = u => {
   if (u && typeof u === 'string') {
     const p = url.parse(u)
-    return !!(p.protocol && p.slashes && p.host && p.path)
+    return p.slashes && p.host && p.path && /^https?:$/.test(p.protocol)
   }
   return false
 }
diff --git a/lib/test/login.js b/lib/test/login.js
index 09cf947..5c90773 100644
--- a/lib/test/login.js
+++ b/lib/test/login.js
@@ -137,7 +137,7 @@ const server = http.createServer((q, s) => {
 
       case '/invalid-login-url/-/v1/login':
         return respond(s, 200, {
-          loginUrl: 'this is not a url',
+          loginUrl: 'ftp://this.is/not-a-webpage/now/is/it?',
           doneUrl: reg + '/invalid-done/-/v1/login'
         })
 
@@ -418,7 +418,7 @@ t.test('fail at login step by having an invalid url', t => {
     method: 'POST',
     uri: reg + '/invalid-login-url/-/v1/login',
     body: {
-      loginUrl: 'this is not a url',
+      loginUrl: 'ftp://this.is/not-a-webpage/now/is/it?',
       doneUrl: reg + '/invalid-done/-/v1/login'
     },
     message: 'Invalid response from web login endpoint'