security audit fix start

web/src/server/api/schemas/billing.ts

@@ -1,12 +1,13 @@
-import { object, string, url, minLength, optional, picklist } from "valibot";
+import { object, string, minLength, optional, picklist } from "valibot";
+import { returnUrlSchema } from "~/lib/url-validation";
 
 export const CreateCheckoutSessionSchema = object({
   priceId: string([minLength(1)]),
-  returnUrl: string([url()]),
+  returnUrl: returnUrlSchema,
 });
 
 export const CreatePortalSessionSchema = object({
-  returnUrl: string([url()]),
+  returnUrl: returnUrlSchema,
 });
 
 export const CancelSubscriptionSchema = object({
@@ -28,5 +29,5 @@ export const RequestFeatureTrialSchema = object({
 
 export const UpgradeFromTrialSchema = object({
   plan: picklist(["basic", "plus", "premium"]),
-  returnUrl: string([url()]),
+  returnUrl: returnUrlSchema,
 });