Harden url validation in logo endpoint

apps/api/src/app/logo/get-logo.dto.ts

@@ -0,0 +1,9 @@
+import { IsUrl } from 'class-validator';
+
+export class GetLogoDto {
+  @IsUrl({
+    protocols: ['http', 'https'],
+    require_protocol: true
+  })
+  url: string;
+}

apps/api/src/app/logo/logo.controller.ts

@@ -12,6 +12,7 @@ import {
 import { DataSource } from '@prisma/client';
 import { Response } from 'express';
 
+import { GetLogoDto } from './get-logo.dto';
 import { LogoService } from './logo.service';
 
 @Controller('logo')
@@ -41,7 +42,7 @@ export class LogoController {
 
   @Get()
   public async getLogoByUrl(
-    @Query('url') url: string,
+    @Query() { url }: GetLogoDto,
     @Res() response: Response
   ) {
     try {

apps/api/src/app/logo/logo.service.ts

@@ -47,7 +47,7 @@ export class LogoService {
   private async getBuffer(aUrl: string) {
     const blob = await this.fetchService
       .fetch(
-        `https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=${aUrl}&size=64`,
+        `https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&fallback_opts=TYPE,SIZE,URL&url=${encodeURIComponent(aUrl)}&size=64`,
         {
           headers: { 'User-Agent': 'request' },
           signal: AbortSignal.timeout(