Restrict OAuth client branding URLs to http(s)

CIMD and registration accepted any URI scheme for client_uri and
logo_uri, so allowlisted metadata could surface javascript: links on
sign-in. Validate absolute http/https at ingest and only expose those
schemes in branding.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/iam/oauth2/cimd.go

@@ -40,6 +40,7 @@ import (
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/netx"
+	"go.probo.inc/probo/pkg/uri"
 )
 
 const (
@@ -257,6 +258,14 @@ func validateClientMetadataDocument(clientIDURL string, doc *ClientMetadataDocum
 		}
 	}
 
+	if err := validateCIMDWebURI(doc.ClientURI, "client_uri"); err != nil {
+		return err
+	}
+
+	if err := validateCIMDWebURI(doc.LogoURI, "logo_uri"); err != nil {
+		return err
+	}
+
 	authMethod := doc.TokenEndpointAuthMethod
 	if authMethod == "" {
 		authMethod = string(coredata.OAuth2ClientTokenEndpointAuthMethodNone)
@@ -310,6 +319,22 @@ func validateCIMDRedirectURI(redirectURI string) error {
 	return nil
 }
 
+func validateCIMDWebURI(raw, field string) error {
+	if raw == "" {
+		return nil
+	}
+
+	parsed, err := uri.Parse(raw)
+	if err != nil || !parsed.IsHTTP() {
+		return NewError(
+			ErrInvalidClient,
+			WithDescription("client metadata document contains invalid "+field),
+		)
+	}
+
+	return nil
+}
+
 func (f *cimdFetcher) loadCache(clientIDURL string) (*ClientMetadataDocument, bool) {
 	raw, ok := f.cache.Load(clientIDURL)
 	if !ok {

pkg/iam/oauth2/cimd_test.go

@@ -159,6 +159,45 @@ func TestValidateClientMetadataDocument(t *testing.T) {
 			require.Error(t, err)
 		},
 	)
+
+	t.Run(
+		"https client_uri and logo_uri allowed",
+		func(t *testing.T) {
+			t.Parallel()
+
+			good := doc
+			good.ClientURI = "https://mcp.example.com"
+			good.LogoURI = "https://mcp.example.com/logo.png"
+
+			require.NoError(t, validateClientMetadataDocument(clientID, &good))
+		},
+	)
+
+	t.Run(
+		"non-web client_uri rejected",
+		func(t *testing.T) {
+			t.Parallel()
+
+			bad := doc
+			bad.ClientURI = "javascript://example.com/%0Aalert(1)"
+
+			err := validateClientMetadataDocument(clientID, &bad)
+			require.Error(t, err)
+		},
+	)
+
+	t.Run(
+		"non-web logo_uri rejected",
+		func(t *testing.T) {
+			t.Parallel()
+
+			bad := doc
+			bad.LogoURI = "data://example.com/image"
+
+			err := validateClientMetadataDocument(clientID, &bad)
+			require.Error(t, err)
+		},
+	)
 }
 
 func TestCIMDFetcherFetch(t *testing.T) {

pkg/iam/oauth2/client_branding.go

@@ -53,12 +53,14 @@ func ClientBrandingFromClient(client *coredata.OAuth2Client) *ClientBranding {
 		Name: client.ClientName,
 	}
 
-	if client.ClientURI != nil {
+	// Only expose absolute http(s) URLs. Metadata may historically contain
+	// non-web schemes; branding must not surface those as links or image src.
+	if client.ClientURI != nil && client.ClientURI.IsHTTP() {
 		clientURL := client.ClientURI.String()
 		branding.ClientURL = &clientURL
 	}
 
-	if client.LogoURI != nil {
+	if client.LogoURI != nil && client.LogoURI.IsHTTP() {
 		logoURL := client.LogoURI.String()
 		branding.LogoURL = &logoURL
 	}

pkg/iam/oauth2/client_branding_test.go

@@ -28,21 +28,45 @@ import (
 func TestClientBrandingFromClient(t *testing.T) {
 	t.Parallel()
 
-	clientURL := uri.URI("https://example.com")
-	logoURL := uri.URI("https://example.com/logo.png")
+	t.Run("exposes http and https client urls", func(t *testing.T) {
+		t.Parallel()
 
-	branding := ClientBrandingFromClient(
-		&coredata.OAuth2Client{
-			ClientName: "Acme",
-			ClientURI:  &clientURL,
-			LogoURI:    &logoURL,
-		},
-	)
+		clientURL := uri.URI("https://example.com")
+		logoURL := uri.URI("https://example.com/logo.png")
 
-	require.NotNil(t, branding)
-	assert.Equal(t, "Acme", branding.Name)
-	assert.Equal(t, "https://example.com", *branding.ClientURL)
-	assert.Equal(t, "https://example.com/logo.png", *branding.LogoURL)
+		branding := ClientBrandingFromClient(
+			&coredata.OAuth2Client{
+				ClientName: "Acme",
+				ClientURI:  &clientURL,
+				LogoURI:    &logoURL,
+			},
+		)
+
+		require.NotNil(t, branding)
+		assert.Equal(t, "Acme", branding.Name)
+		assert.Equal(t, "https://example.com", *branding.ClientURL)
+		assert.Equal(t, "https://example.com/logo.png", *branding.LogoURL)
+	})
+
+	t.Run("omits non-web client and logo urls", func(t *testing.T) {
+		t.Parallel()
+
+		clientURL := uri.URI("javascript://example.com/%0Aalert(1)")
+		logoURL := uri.URI("data://example.com/image")
+
+		branding := ClientBrandingFromClient(
+			&coredata.OAuth2Client{
+				ClientName: "Acme",
+				ClientURI:  &clientURL,
+				LogoURI:    &logoURL,
+			},
+		)
+
+		require.NotNil(t, branding)
+		assert.Equal(t, "Acme", branding.Name)
+		assert.Nil(t, branding.ClientURL)
+		assert.Nil(t, branding.LogoURL)
+	})
 }
 
 func TestClientBranding_EmptyClientID(t *testing.T) {

pkg/iam/oauth2/register_client_test.go

@@ -0,0 +1,71 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package oauth2
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/coredata"
+	"go.probo.inc/probo/pkg/uri"
+)
+
+func TestRegisterClient_RejectsNonWebURIs(t *testing.T) {
+	t.Parallel()
+
+	svc := NewService(nil, nil, "", log.NewLogger())
+
+	t.Run(
+		"non-web client_uri",
+		func(t *testing.T) {
+			t.Parallel()
+
+			clientURI := uri.URI("javascript://example.com/%0Aalert(1)")
+
+			_, _, err := svc.RegisterClient(
+				context.Background(),
+				&RegisterClientRequest{
+					ClientName:   "Acme",
+					Visibility:   coredata.OAuth2ClientVisibilityPublic,
+					RedirectURIs: []uri.URI{"https://example.com/callback"},
+					ClientURI:    &clientURI,
+				},
+			)
+			require.Error(t, err)
+		},
+	)
+
+	t.Run(
+		"non-web logo_uri",
+		func(t *testing.T) {
+			t.Parallel()
+
+			logoURI := uri.URI("data://example.com/image")
+
+			_, _, err := svc.RegisterClient(
+				context.Background(),
+				&RegisterClientRequest{
+					ClientName:   "Acme",
+					Visibility:   coredata.OAuth2ClientVisibilityPublic,
+					RedirectURIs: []uri.URI{"https://example.com/callback"},
+					LogoURI:      &logoURI,
+				},
+			)
+			require.Error(t, err)
+		},
+	)
+}

pkg/iam/oauth2/service.go

@@ -1103,6 +1103,24 @@ func (s *Service) RegisterClient(
 		}
 	}
 
+	if req.ClientURI != nil && !req.ClientURI.IsHTTP() {
+		return gid.Nil,
+			"",
+			NewError(
+				ErrInvalidRequest,
+				WithDescription("client_uri must be an absolute http or https URL"),
+			)
+	}
+
+	if req.LogoURI != nil && !req.LogoURI.IsHTTP() {
+		return gid.Nil,
+			"",
+			NewError(
+				ErrInvalidRequest,
+				WithDescription("logo_uri must be an absolute http or https URL"),
+			)
+	}
+
 	var (
 		plaintextSecret string
 		secretHash      []byte