From b4568c964385b6f32e6f293a0f4fba97780a29b5 Mon Sep 17 00:00:00 2001 From: Sage Hart Date: Sun, 31 May 2026 08:39:06 -0500 Subject: [PATCH] Potential fix for code scanning alert no. 1: Incomplete URL substring sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- src/lib/operationalWebhook/channelAdapters.ts | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/src/lib/operationalWebhook/channelAdapters.ts b/src/lib/operationalWebhook/channelAdapters.ts index edf2ddf..f8cbc2a 100644 --- a/src/lib/operationalWebhook/channelAdapters.ts +++ b/src/lib/operationalWebhook/channelAdapters.ts @@ -25,12 +25,18 @@ export function operationalWebhookEventTitle(eventType: string): string { /** Infer Slack / Teams formatting from webhook URL host. */ export function detectNotificationChannel(targetUrl: string): NotificationChannel { try { - const host = new URL(targetUrl).host.toLowerCase(); - if (host.includes("hooks.slack.com") || host.includes("slack.com")) return "slack"; + const hostname = new URL(targetUrl).hostname.toLowerCase(); + const matchesAllowedHost = (allowedHost: string): boolean => + hostname === allowedHost || hostname.endsWith(`.${allowedHost}`); + + if (matchesAllowedHost("hooks.slack.com") || matchesAllowedHost("slack.com")) { + return "slack"; + } + if ( - host.includes("webhook.office.com") || - host.includes("outlook.office.com") || - host.includes("office365.com") + matchesAllowedHost("webhook.office.com") || + matchesAllowedHost("outlook.office.com") || + matchesAllowedHost("office365.com") ) { return "teams"; }