fix(design): require explicit HTTP(S) scheme and bound array sizes for committee metadata fields

The shared urlPattern (website/repository) allowed non-HTTP schemes like
javascript: or data: to pass validation since the scheme prefix was
optional; make it mandatory. Also add MaxLength bounds on scope,
deliverables, and key_dates arrays, matching the existing
description/label size-bound convention, since these are persisted to
NATS KV and indexed with no prior cap.

Addresses PR #149 review feedback from Copilot and CodeRabbit.

Jira: LFXV2-1709
Link: https://linuxfoundation.atlassian.net/browse/LFXV2-1709
Signed-off-by: Prabodh Chaudhari <pchaudhari@linuxfoundation.org>

Author: prabodhcs

cmd/committee-api/design/type.go

@@ -201,8 +201,10 @@ func DescriptionAttribute() {
 	})
 }
 
-// urlPattern validates an optional-scheme URL (used by website and repository attributes).
-const urlPattern = `^(https?://)?[^\s/$.?#].[^\s]*$`
+// urlPattern validates an HTTP(S) URL (used by website and repository attributes).
+// The scheme is mandatory to reject non-HTTP schemes (e.g. javascript:, data:) that
+// would otherwise pass dsl.FormatURI as syntactically valid URIs.
+const urlPattern = `^https?://[^\s/$.?#][^\s]*$`
 
 // WebsiteAttribute is the DSL attribute for committee website.
 func WebsiteAttribute() {
@@ -225,13 +227,21 @@ func RepositoryAttribute() {
 // ScopeAttribute is the DSL attribute for committee scope bullet points.
 func ScopeAttribute() {
 	dsl.Attribute("scope", dsl.ArrayOf(dsl.String), "The scope of the committee, as a list of bullet points", func() {
+		dsl.MaxLength(50)
+		dsl.Elem(func() {
+			dsl.MaxLength(500)
+		})
 		dsl.Example([]string{"Define governance for the project", "Review and approve major architectural changes"})
 	})
 }
 
 // DeliverablesAttribute is the DSL attribute for committee deliverables bullet points.
 func DeliverablesAttribute() {
 	dsl.Attribute("deliverables", dsl.ArrayOf(dsl.String), "The deliverables of the committee, as a list of bullet points", func() {
+		dsl.MaxLength(50)
+		dsl.Elem(func() {
+			dsl.MaxLength(500)
+		})
 		dsl.Example([]string{"Quarterly technical roadmap", "Annual governance review"})
 	})
 }
@@ -256,6 +266,7 @@ var KeyDateType = dsl.Type("key-date", func() {
 // KeyDatesAttribute is the DSL attribute for a committee's key-dates timeline.
 func KeyDatesAttribute() {
 	dsl.Attribute("key_dates", dsl.ArrayOf(KeyDateType), "Timeline of important dates for the committee", func() {
+		dsl.MaxLength(50)
 		dsl.Example([]map[string]interface{}{
 			{"date": "2026-04", "label": "Charter renewal"},
 		})

cmd/committee-api/design/type_test.go

@@ -0,0 +1,35 @@
+// Copyright The Linux Foundation and each contributor to LFX.
+// SPDX-License-Identifier: MIT
+
+package design
+
+import (
+	"regexp"
+	"testing"
+)
+
+func TestURLPattern(t *testing.T) {
+	re := regexp.MustCompile(urlPattern)
+
+	tests := []struct {
+		name  string
+		value string
+		want  bool
+	}{
+		{"https URL", "https://github.com/example/repo", true},
+		{"http URL", "http://committee.example.org", true},
+		{"javascript scheme rejected", "javascript:alert(1)", false},
+		{"data scheme rejected", "data:text/html,<script>alert(1)</script>", false},
+		{"file scheme rejected", "file:///etc/passwd", false},
+		{"schemeless domain rejected", "committee.example.org", false},
+		{"empty string rejected", "", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := re.MatchString(tt.value); got != tt.want {
+				t.Errorf("urlPattern.MatchString(%q) = %v, want %v", tt.value, got, tt.want)
+			}
+		})
+	}
+}