Add configurations for allowed protocols for HTTP and HDFS inputSources/firehoses

core/src/main/java/org/apache/druid/data/input/impl/HttpInputSource.java

@@ -59,6 +59,7 @@ public HttpInputSource(
   )
   {
     Preconditions.checkArgument(uris != null && !uris.isEmpty(), "Empty URIs");
+    throwIfInvalidProtocols(uris);
     uris.forEach(uri -> Preconditions.checkArgument(
         config.isURIAllowed(uri),
         StringUtils.format("Access to [%s] DENIED!", uri)
@@ -69,6 +70,13 @@ public HttpInputSource(
     this.config = config;
   }
 
+  private static void throwIfInvalidProtocols(List<URI> uris)
+  {
+    if (uris.stream().anyMatch(uri -> !"http".equalsIgnoreCase(uri.getScheme()) && !"https".equalsIgnoreCase(uri.getScheme()))) {
+      throw new IllegalArgumentException("Only HTTP or HTTPS are allowed");
+    }
+  }
+
   @JsonProperty
   public List<URI> getUris()
   {

core/src/test/java/org/apache/druid/data/input/impl/HttpInputSourceTest.java

@@ -25,14 +25,19 @@
 import org.apache.druid.data.input.InputSource;
 import org.apache.druid.metadata.DefaultPasswordProvider;
 import org.junit.Assert;
+import org.junit.Rule;
 import org.junit.Test;
+import org.junit.rules.ExpectedException;
 
 import java.io.IOException;
 import java.net.URI;
 import java.util.Collections;
 
 public class HttpInputSourceTest
 {
+  @Rule
+  public ExpectedException expectedException = ExpectedException.none();
+
   @Test
   public void testSerde() throws IOException
   {
@@ -78,6 +83,33 @@ public void testDenyListDomainNoMatch()
     );
   }
 
+  @Test
+  public void testConstructorAllowsOnlyHttpAndHttpsProtocols()
+  {
+    new HttpInputSource(
+        ImmutableList.of(URI.create("http:///")),
+        "myName",
+        new DefaultPasswordProvider("myPassword"),
+        new HttpInputSourceConfig(null, null)
+    );
+
+    new HttpInputSource(
+        ImmutableList.of(URI.create("https:///")),
+        "myName",
+        new DefaultPasswordProvider("myPassword"),
+        new HttpInputSourceConfig(null, null)
+    );
+
+    expectedException.expect(IllegalArgumentException.class);
+    expectedException.expectMessage("Only HTTP or HTTPS are allowed");
+    new HttpInputSource(
+        ImmutableList.of(URI.create("my-protocol:///")),
+        "myName",
+        new DefaultPasswordProvider("myPassword"),
+        new HttpInputSourceConfig(null, null)
+    );
+  }
+
   @Test(expected = IllegalArgumentException.class)
   public void testAllowListDomainThrowsException()
   {