Restrict OAuth client branding URLs to http(s)

CIMD and registration accepted any URI scheme for client_uri and
logo_uri, so allowlisted metadata could surface javascript: links on
sign-in. Validate absolute http/https at ingest and only expose those
schemes in branding.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/iam/oauth2/client_branding_test.go

@@ -28,21 +28,45 @@ import (
 func TestClientBrandingFromClient(t *testing.T) {
 	t.Parallel()
 
-	clientURL := uri.URI("https://example.com")
-	logoURL := uri.URI("https://example.com/logo.png")
+	t.Run("exposes http and https client urls", func(t *testing.T) {
+		t.Parallel()
 
-	branding := ClientBrandingFromClient(
-		&coredata.OAuth2Client{
-			ClientName: "Acme",
-			ClientURI:  &clientURL,
-			LogoURI:    &logoURL,
-		},
-	)
+		clientURL := uri.URI("https://example.com")
+		logoURL := uri.URI("https://example.com/logo.png")
 
-	require.NotNil(t, branding)
-	assert.Equal(t, "Acme", branding.Name)
-	assert.Equal(t, "https://example.com", *branding.ClientURL)
-	assert.Equal(t, "https://example.com/logo.png", *branding.LogoURL)
+		branding := ClientBrandingFromClient(
+			&coredata.OAuth2Client{
+				ClientName: "Acme",
+				ClientURI:  &clientURL,
+				LogoURI:    &logoURL,
+			},
+		)
+
+		require.NotNil(t, branding)
+		assert.Equal(t, "Acme", branding.Name)
+		assert.Equal(t, "https://example.com", *branding.ClientURL)
+		assert.Equal(t, "https://example.com/logo.png", *branding.LogoURL)
+	})
+
+	t.Run("omits non-web client and logo urls", func(t *testing.T) {
+		t.Parallel()
+
+		clientURL := uri.URI("javascript://example.com/%0Aalert(1)")
+		logoURL := uri.URI("data://example.com/image")
+
+		branding := ClientBrandingFromClient(
+			&coredata.OAuth2Client{
+				ClientName: "Acme",
+				ClientURI:  &clientURL,
+				LogoURI:    &logoURL,
+			},
+		)
+
+		require.NotNil(t, branding)
+		assert.Equal(t, "Acme", branding.Name)
+		assert.Nil(t, branding.ClientURL)
+		assert.Nil(t, branding.LogoURL)
+	})
 }
 
 func TestClientBranding_EmptyClientID(t *testing.T) {