From 67740a00bd945365358610c0afeadf1a45bc795b Mon Sep 17 00:00:00 2001 From: diegosouzapw Date: Tue, 7 Apr 2026 23:56:10 -0300 Subject: [PATCH] fix(security): replace includes with startsWith for CodeQL url sanitization --- tests/unit/chatcore-translation-paths.test.mjs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/unit/chatcore-translation-paths.test.mjs b/tests/unit/chatcore-translation-paths.test.mjs index 5d1f849580..dbb33677af 100644 --- a/tests/unit/chatcore-translation-paths.test.mjs +++ b/tests/unit/chatcore-translation-paths.test.mjs @@ -806,7 +806,7 @@ test("chatCore refreshes GitHub credentials after 401 and retries with the refre refreshedCredentials = updated; }, responseFactory(captured, seenCalls) { - if (captured.url.includes("https://api.github.com/copilot_internal/v2/token")) { + if (captured.url.startsWith("https://api.github.com/copilot_internal/v2/token")) { return new Response( JSON.stringify({ token: "copilot-refreshed-token", @@ -820,7 +820,7 @@ test("chatCore refreshes GitHub credentials after 401 and retries with the refre } const providerCalls = seenCalls.filter((entry) => - entry.url.includes("https://api.githubcopilot.com/") + entry.url.startsWith("https://api.githubcopilot.com/") ); if (providerCalls.length === 1) { return new Response( @@ -839,7 +839,7 @@ test("chatCore refreshes GitHub credentials after 401 and retries with the refre }); const payload = await result.response.json(); - const providerCalls = calls.filter((entry) => entry.url.includes("https://api.githubcopilot.com/")); + const providerCalls = calls.filter((entry) => entry.url.startsWith("https://api.githubcopilot.com/")); assert.equal(result.success, true); assert.equal(providerCalls.length, 2);