message: Tighten the validation around OAuth URLs
diff: @@ -32,7 +32,7 @@ func validateAbsURL(value string) error {
  return err
  }
  - if ur == nil || !ur.IsAbs() {
  + if ur == nil || ur.String() == "" || ur.Scheme == "" || ur.Host == "" {
  return fmt.Errorf("url is not absolute: %v", ur)
  }
  @@ -61,6 +61,7 @@ func newOpenShiftAuth(ctx context.Context, c *openShiftConfig) (oauth2.Endpoint,
  }
  var metadata struct {
  + Issuer string `json:"issuer"`
  Auth string `json:"authorization_endpoint"`
  Token string `json:"token_endpoint"`
  }
  @@ -70,6 +71,10 @@ func newOpenShiftAuth(ctx context.Context, c *openShiftConfig) (oauth2.Endpoint,
  wellKnownURL, err)
  }
  + if err := validateAbsURL(metadata.Issuer); err != nil {
  + return oauth2.Endpoint{}, nil, err
  + }
  +
  if err := validateAbsURL(metadata.Auth); err != nil {
  return oauth2.Endpoint{}, nil, err
  }
  