From a907ae714c2fe2140dd3662db609cb4c0918fde5 Mon Sep 17 00:00:00 2001
From: diegosouzapw <diegosouza.pw@gmail.com>
Date: Tue, 2 Jun 2026 23:40:22 -0300
Subject: [PATCH] test(security): parse hostname instead of URL substring match
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace `result.url.includes("poe.com")` / `.includes("doubao.com")` with a
parsed `new URL(result.url).hostname` check that accepts the exact host or a
legitimate subdomain (`.endsWith(".poe.com")`). The substring form also matches
hostile URLs like `https://evil.com/?x=poe.com`, which CodeQL flags as
js/incomplete-url-substring-sanitization (2 high-severity alerts on PR #2930).
This strengthens the assertion rather than masking it — the executors build
`https://www.poe.com` / `https://www.doubao.com`, both still satisfied.
---
 tests/unit/executor-doubao-web.test.ts | 6 +++++-
 tests/unit/executor-poe-web.test.ts    | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/tests/unit/executor-doubao-web.test.ts b/tests/unit/executor-doubao-web.test.ts
index 7d78469ceb..3ac5cd9015 100644
--- a/tests/unit/executor-doubao-web.test.ts
+++ b/tests/unit/executor-doubao-web.test.ts
@@ -20,7 +20,11 @@ describe("DoubaoWebExecutor", () => {
         signal: null,
       });
       assert.ok(result.response instanceof Response);
-      assert.ok(result.url.includes("doubao.com"));
+      // Parse the host instead of substring-matching the URL: a bare
+      // `.includes("doubao.com")` would also accept hostile URLs like
+      // `https://evil.com/?x=doubao.com` (CodeQL js/incomplete-url-substring-sanitization).
+      const host = new URL(result.url).hostname;
+      assert.ok(host === "doubao.com" || host.endsWith(".doubao.com"), `unexpected host: ${host}`);
     } catch {
       // Network error expected
     }
diff --git a/tests/unit/executor-poe-web.test.ts b/tests/unit/executor-poe-web.test.ts
index 726ab88e60..44324c5a79 100644
--- a/tests/unit/executor-poe-web.test.ts
+++ b/tests/unit/executor-poe-web.test.ts
@@ -20,7 +20,11 @@ describe("PoeWebExecutor", () => {
         signal: null,
       });
       assert.ok(result.response instanceof Response);
-      assert.ok(result.url.includes("poe.com"));
+      // Parse the host instead of substring-matching the URL: a bare
+      // `.includes("poe.com")` would also accept hostile URLs like
+      // `https://evil.com/?x=poe.com` (CodeQL js/incomplete-url-substring-sanitization).
+      const host = new URL(result.url).hostname;
+      assert.ok(host === "poe.com" || host.endsWith(".poe.com"), `unexpected host: ${host}`);
     } catch {
       // Network error expected
     }