From 3b2a2f02a94c4a85efe21376a1dd55bd804d9a2a Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Sat, 20 Jun 2026 11:23:07 -0300
Subject: [PATCH] =?UTF-8?q?test:=20exact=20host=20membership=20in=20MITM?=
 =?UTF-8?q?=20hosts=20test=20=E2=80=94=20CodeQL=20FP=20(#660)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use exact array-element membership (.some((h) => h === host)) instead of Array.prototype.includes() in the MITM hosts unit test, so CodeQL's js/incomplete-url-substring-sanitization heuristic does not misread an Array.includes membership check as a String.includes URL-substring test. Functionally identical. Mirrors #4386 (already merged into release/v3.8.31). Closes the only open code-scanning alert (#660).
---
 tests/unit/mitm-tool-hosts.test.ts | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/unit/mitm-tool-hosts.test.ts b/tests/unit/mitm-tool-hosts.test.ts
index 9023cfabf7..eee684019b 100644
--- a/tests/unit/mitm-tool-hosts.test.ts
+++ b/tests/unit/mitm-tool-hosts.test.ts
@@ -21,6 +21,9 @@ test("MITM_TOOL_HOSTS stays in sync with the canonical MITM target registry", ()
 });
 
 test("getMitmToolHosts returns the hosts for a known tool and [] for unknown ids", () => {
-  assert.ok(getMitmToolHosts("antigravity").includes("cloudcode-pa.googleapis.com"));
+  // Exact array-element membership (getMitmToolHosts returns string[]). Use `.some(===)`
+  // rather than `.includes()` so CodeQL's js/incomplete-url-substring-sanitization does not
+  // misread this Array.includes as a String.includes URL-substring check (false positive).
+  assert.ok(getMitmToolHosts("antigravity").some((h) => h === "cloudcode-pa.googleapis.com"));
   assert.deepEqual(getMitmToolHosts("does-not-exist"), []);
 });