fix: close catalog review gaps

backend/src/auth/url-policy.ts

@@ -3,6 +3,18 @@ export interface ConfiguredTransportUrlOptions {
   originOnly?: boolean;
 }
 
+export function parseCredentialFreeHttpUrl(value: string): URL | undefined {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    return undefined;
+  }
+  if (!["http:", "https:"].includes(url.protocol)
+    || url.username || url.password || url.search || url.hash) return undefined;
+  return url;
+}
+
 function canonicalLoopbackAuthority(value: string): boolean {
   const match = /^http:\/\/([^/?#]+)(?:[/?#]|$)/.exec(value);
   if (!match) return false;
@@ -27,15 +39,8 @@ export function parseConfiguredTransportUrl(
   value: string,
   options: ConfiguredTransportUrlOptions,
 ): URL | undefined {
-  let url: URL;
-  try {
-    url = new URL(value);
-  } catch {
-    return undefined;
-  }
-  if (url.username || url.password || url.search || url.hash || (options.originOnly && url.pathname !== "/")) {
-    return undefined;
-  }
+  const url = parseCredentialFreeHttpUrl(value);
+  if (!url || (options.originOnly && url.pathname !== "/")) return undefined;
   if (url.protocol === "https:") return url;
   if (options.allowLoopbackHttp && url.protocol === "http:" && canonicalLoopbackAuthority(value)) return url;
   return undefined;