From e4f96a3c9bf66a8755654a705e02bff513904156 Mon Sep 17 00:00:00 2001 From: Sage Hart Date: Sun, 31 May 2026 08:38:37 -0500 Subject: [PATCH] Potential fix for code scanning alert no. 4: Incomplete URL substring sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- src/lib/operationalWebhook/channelAdapters.ts | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/src/lib/operationalWebhook/channelAdapters.ts b/src/lib/operationalWebhook/channelAdapters.ts index edf2ddf..37ac5e1 100644 --- a/src/lib/operationalWebhook/channelAdapters.ts +++ b/src/lib/operationalWebhook/channelAdapters.ts @@ -22,15 +22,24 @@ export function operationalWebhookEventTitle(eventType: string): string { return EVENT_TITLES[eventType] ?? eventType; } +function isHostnameAllowed(hostname: string, domain: string): boolean { + return hostname === domain || hostname.endsWith(`.${domain}`); +} + /** Infer Slack / Teams formatting from webhook URL host. */ export function detectNotificationChannel(targetUrl: string): NotificationChannel { try { - const host = new URL(targetUrl).host.toLowerCase(); - if (host.includes("hooks.slack.com") || host.includes("slack.com")) return "slack"; + const hostname = new URL(targetUrl).hostname.toLowerCase(); + if ( + isHostnameAllowed(hostname, "hooks.slack.com") || + isHostnameAllowed(hostname, "slack.com") + ) { + return "slack"; + } if ( - host.includes("webhook.office.com") || - host.includes("outlook.office.com") || - host.includes("office365.com") + isHostnameAllowed(hostname, "webhook.office.com") || + isHostnameAllowed(hostname, "outlook.office.com") || + isHostnameAllowed(hostname, "office365.com") ) { return "teams"; }