From 1ee032b26f4b54c06de3ba494deb9d9a1d5ca81f Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 20 Jul 2026 16:36:53 +0000 Subject: [PATCH 1/2] Initial plan From f40223956da7495f13a80c0224316400f031ea96 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 20 Jul 2026 16:39:19 +0000 Subject: [PATCH 2/2] Fix incomplete URL substring sanitization (CodeQL alert #12) --- .../skills/paper2assets/scripts/extract_pdf.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ResearchStudio-Reel/skills/paper2assets/scripts/extract_pdf.py b/ResearchStudio-Reel/skills/paper2assets/scripts/extract_pdf.py index ac56f00..c84edf8 100755 --- a/ResearchStudio-Reel/skills/paper2assets/scripts/extract_pdf.py +++ b/ResearchStudio-Reel/skills/paper2assets/scripts/extract_pdf.py @@ -21,6 +21,7 @@ we extract them alongside the images and let the model match figures to captions. """ import argparse, json, re, subprocess, sys +from urllib.parse import urlparse from pathlib import Path # Make `utils` importable when this file is run directly (mirrors the pattern in @@ -806,7 +807,9 @@ def parse_metadata(text: str) -> dict: continue if "arxiv.org" in url: continue - if "github.io" in url or is_project_line or re.search(r"\.(io|dev|page)/", url): + parsed_host = urlparse(url).hostname or "" + is_github_io = parsed_host == "github.io" or parsed_host.endswith(".github.io") + if is_github_io or is_project_line or re.search(r"\.(io|dev|page)/", url): candidates.append(url) if candidates: metadata["project_url"] = candidates[0]