brave
Allow only URLs with `https` protocol during campaign creation
Description
When creating a new campaign, an attacker may use arbitrary protocols to inject javascript or OS command link vectors.
Reproduction Steps
Proposed fix
Disallow any URL not employing https scheme.
Cc @tackley
@tackley this seems like an important security feature, could you take a look?
This issue is stale because it has been open for over a year with no activity. Remove stale label or add a comment to avoid this being closed in a weeks time.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
This issue was closed because it has been inactive for a week since being marked as stale.
This should be fixed as of: https://github.com/brave/ads-serve/pull/2901
