[GX-2017-0003]: Fix for the reported issue, only allow http, https, and

ftp schemes in the data_source tool.

tools/data_source/data_source.py

@@ -6,7 +6,7 @@
 import sys
 from json import dumps, loads
 
-from six.moves.urllib.parse import urlencode
+from six.moves.urllib.parse import urlencode, urlparse
 from six.moves.urllib.request import urlopen
 
 from galaxy.datatypes import sniff
@@ -80,7 +80,7 @@ def __main__():
     for data_dict in job_params['output_data']:
         cur_filename = data_dict.get('file_name', filename)
         cur_URL = params.get('%s|%s|URL' % (GALAXY_PARAM_PREFIX, data_dict['out_data_name']), URL)
-        if not cur_URL:
+        if not cur_URL or urlparse(cur_URL).scheme not in ('http', 'https', 'ftp'):
             open(cur_filename, 'w').write("")
             stop_err('The remote data source application has not sent back a URL parameter in the request.')