From ed2210d929258e397a61f165cd095fe3807edd31 Mon Sep 17 00:00:00 2001 From: Sage Hart Date: Sun, 31 May 2026 08:38:47 -0500 Subject: [PATCH] Potential fix for code scanning alert no. 3: Incomplete URL substring sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- src/lib/operationalWebhook/channelAdapters.ts | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/src/lib/operationalWebhook/channelAdapters.ts b/src/lib/operationalWebhook/channelAdapters.ts index edf2ddf..e2880ee 100644 --- a/src/lib/operationalWebhook/channelAdapters.ts +++ b/src/lib/operationalWebhook/channelAdapters.ts @@ -25,12 +25,15 @@ export function operationalWebhookEventTitle(eventType: string): string { /** Infer Slack / Teams formatting from webhook URL host. */ export function detectNotificationChannel(targetUrl: string): NotificationChannel { try { - const host = new URL(targetUrl).host.toLowerCase(); - if (host.includes("hooks.slack.com") || host.includes("slack.com")) return "slack"; + const host = new URL(targetUrl).hostname.toLowerCase().replace(/\.$/, ""); + const matchesDomain = (domain: string): boolean => + host === domain || host.endsWith(`.${domain}`); + + if (matchesDomain("hooks.slack.com") || matchesDomain("slack.com")) return "slack"; if ( - host.includes("webhook.office.com") || - host.includes("outlook.office.com") || - host.includes("office365.com") + matchesDomain("webhook.office.com") || + matchesDomain("outlook.office.com") || + matchesDomain("office365.com") ) { return "teams"; }