strengthen email/URL validation: require the objects to be strings

resources/static/dialog/controllers/dialog.js

@@ -84,6 +84,8 @@ BrowserID.Modules.Dialog = (function() {
 
   function fixupURL(origin, url) {
     var u;
+    if (typeof(url) !== "string")
+      throw "urls must be strings: (" + url + ")";
     if (/^http(s)?:\/\//.test(url)) u = URLParse(url);
     else if (/^\//.test(url)) u = URLParse(origin + url);
     else throw "relative urls not allowed: (" + url + ")";

resources/static/shared/validation.js

@@ -7,6 +7,8 @@ BrowserID.Validation = (function() {
       tooltip = bid.Tooltip;
 
   bid.verifyEmail = function(address) {
+    if (typeof(address) !== "string")
+      return false;
     // Original gotten from http://blog.gerv.net/2011/05/html5_email_address_regexp/
     // changed the requirement that there must be a ldh-str because BrowserID
     // is only used on internet based networks.