Validate that the homepage is using an approved scheme.

utils/pub/pubspec.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library pubspec;
 
 import 'package.dart';
 import 'source.dart';
 import 'source_registry.dart';
 import 'utils.dart';
@@ skipping 58 matching lines @@
     if (parsedPubspec.containsKey('version')) {
       version = new Version.parse(parsedPubspec['version']);
     }
 
     var dependencies = _parseDependencies(sources,
         parsedPubspec['dependencies']);
 
     // Even though the pub app itself doesn't use these fields, we validate
     // them here so that users find errors early before they try to upload to
     // the server:
+    // TODO(rnystrom): We should split this validation into separate layers:
+    // 1. Stuff that is required in any pubspec to perform any command. Things
+    //    like "must have a name". That should go here.
+    // 2. Stuff that is required to upload a package. Things like "homepage
+    //    must use a valid scheme". That should go elsewhere. pub upload should
+    //    call it, and we should provide a separate command to show the user,
+    //    and also expose it to the editor in some way.
 
-    if (parsedPubspec.containsKey('homepage') &&
-        parsedPubspec['homepage'] is! String) {
-      throw new FormatException(
-          'The "homepage" field should be a string, but was '
-          '${parsedPubspec["homepage"]}.');
+    if (parsedPubspec.containsKey('homepage')) {
+      var homepage = parsedPubspec['homepage'];
+
+      if (homepage is! String) {
+        throw new FormatException(
+            'The "homepage" field should be a string, but was "$homepage".');
+      }
+
+      var goodScheme = new RegExp(r'^https?:');
+      if (!goodScheme.hasMatch(homepage)) {
+        throw new FormatException(
+            'The "homepage" field should be an "http:" or "https:" URL, but '
+            'was "$homepage".');
+      }
     }
 
     if (parsedPubspec.containsKey('author') &&
         parsedPubspec['author'] is! String) {
       throw new FormatException(
           'The "author" field should be a string, but was '
           '${parsedPubspec["author"]}.');
     }
 
     if (parsedPubspec.containsKey('authors')) {
@@ skipping 66 matching lines @@
     }
 
     source.validateDescription(description, fromLockFile: false);
 
     dependencies.add(new PackageRef(
         name, source, versionConstraint, description));
   });
 
   return dependencies;
 }