No RPC URL validation: CLI accepts any string as --rpc-url with no scheme or format verification

[ALLEN-AYODEJI]

Description

The CLI accepts any string as STELLAR_RPC_URL without validating it is a valid HTTPS URL. An attacker who can control the env vars (e.g., via a compromised .env file) could point the CLI at a malicious RPC endpoint that returns forged transaction results. Additionally, there is no enforcement that the RPC URL uses HTTPS (not HTTP) in production.

Requirements and context

• Security: Standard security review required for state-mutating changes
• Testing: Full test suite must pass; new tests for changed behavior
• Documentation: Update doc comments and README if user-facing

Suggested execution

Branch: fix/fix/security-rpc-url-validation

Implement changes

• Add URL validation in config.rs using url crate or basic parsing
• Require https:// scheme for non-localhost URLs, allow http:// for localhost/devnet
• Warn when connecting to a non-HTTPS endpoint in production mode
• Add a --unsafe-rpc flag to explicitly allow HTTP for development

Test and commit

Test with invalid URL (not-a-url) — verify error. Test with http:// for localhost — verify warning. Test with https:// for testnet — verify passes. Run cargo test.

Example commit message

fix(security): enforce HTTPS-only RPC URL validation with localhost exception for development

Guidelines

• Open a PR against master
• Keep PR focused on this single concern
• Run cargo test or npm test before review
• Ensure no lint or typecheck warnings