validURL.js: Fix remote code execution