fix harden preview against self XSS

Signed-off-by: RonniSkansing <rskansing@gmail.com>

backend/model/campaignTemplate.go

@@ -170,6 +170,14 @@ func (c *CampaignTemplate) Validate() error {
 		)
 	}
 
+	// the redirect url is shown as a link in the admin area, so reject any
+	// scheme other than http or https to keep a javascript url out of an href
+	if v, err := c.AfterLandingPageRedirectURL.Get(); err == nil && v.String() != "" {
+		if err := validate.ErrorIfInvalidURL(v.String()); err != nil {
+			return validate.WrapErrorWithField(err, "afterLandingPageRedirectURL")
+		}
+	}
+
 	return nil
 }
 

backend/model/oauthProvider.go

@@ -66,6 +66,19 @@ func (o *OAuthProvider) Validate() error {
 	if err := validate.NullableFieldRequired("clientSecret", o.ClientSecret); err != nil {
 		return err
 	}
+	// the auth url is opened in the operator browser during authorization, so
+	// reject any scheme other than http or https to keep a javascript url out.
+	// the token url is only called server side but is held to the same rule.
+	if v, err := o.AuthURL.Get(); err == nil {
+		if err := validate.ErrorIfNotHTTPURL(v.String()); err != nil {
+			return validate.WrapErrorWithField(err, "authURL")
+		}
+	}
+	if v, err := o.TokenURL.Get(); err == nil {
+		if err := validate.ErrorIfNotHTTPURL(v.String()); err != nil {
+			return validate.WrapErrorWithField(err, "tokenURL")
+		}
+	}
 	return nil
 }