add url validation

config/url.go

@@ -2,12 +2,18 @@ package config
 
 import (
 	"encoding/json"
+	"fmt"
 	"net/url"
+	"regexp"
 	"strings"
 
 	"gopkg.in/yaml.v3"
 )
 
+var (
+	validURLRegexp = regexp.MustCompile(`^(https?://.+|\$\{.+\}.*)$`) // https://regex101.com/r/IvhP6H/1
+)
+
 // URL Custom net.URL compatible with YAML and JSON (un)marshalling and kubebuilder.
 // In addition, it also removes trailing slash if present, so we can easily
 // append a longer path without having to worry about double slashes.
@@ -78,5 +84,8 @@ func (u *URL) DeepCopy() *URL {
 }
 
 func parseURL(s string) (*url.URL, error) {
+	if !validURLRegexp.MatchString(s) {
+		return nil, fmt.Errorf("invalid URL: %s", s)
+	}
 	return url.Parse(strings.TrimSuffix(s, "/"))
 }