repo's uri must start with http(s)
fix bash injection