From 5bc11f4d0e4b73db030703e6a12453ee6d036a49 Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Fri, 3 Jul 2026 02:02:50 -0300
Subject: [PATCH] =?UTF-8?q?test(security):=20fix=20CodeQL=20#689=20?=
 =?UTF-8?q?=E2=80=94=20Kimi=20Web=20URL=20host=20substring=20sanitization?=
 =?UTF-8?q?=20(#6048)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Port the release/v3.8.44 fix to main so the code-scanning alert closes on
the default branch. Parse the URL and assert on the exact hostname instead
of a substring match — `includes("www.kimi.com")` would also accept a
hostile host like `www.kimi.com.evil.net` or `evil.net/?x=www.kimi.com`
(js/incomplete-url-substring-sanitization).
---
 tests/unit/web-cookie-providers-new.test.ts | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/tests/unit/web-cookie-providers-new.test.ts b/tests/unit/web-cookie-providers-new.test.ts
index 1a9d340484..2cc59bcd23 100644
--- a/tests/unit/web-cookie-providers-new.test.ts
+++ b/tests/unit/web-cookie-providers-new.test.ts
@@ -679,8 +679,13 @@ test("Kimi Web: targets www.kimi.com (international)", async () => {
       credentials: { apiKey: "kimi-auth=eyJ.eyJzdWI.signature" },
     });
     assert.ok(result.response instanceof Response);
-    assert.ok(result.url.includes("www.kimi.com"), `got ${result.url}`);
-    assert.ok(!result.url.includes("moonshot.cn"));
+    // Parse the URL and assert on the exact hostname rather than a substring
+    // match — `includes("www.kimi.com")` would also accept a hostile host like
+    // `www.kimi.com.evil.net` or `evil.net/?x=www.kimi.com` (CodeQL
+    // js/incomplete-url-substring-sanitization).
+    const host = new URL(result.url).hostname;
+    assert.equal(host, "www.kimi.com", `got ${result.url}`);
+    assert.notEqual(host, "www.moonshot.cn", `got ${result.url}`);
   } finally {
     restore.restore();
   }