fix: replace real domain URLs with example.test in tests

heimanba · heimanba · commit a20400f62488 · 2026-07-21T15:27:35.000+08:00
Address CodeQL "Incomplete URL substring sanitization" finding by
using reserved example.test domains instead of fonts.googleapis.com
in test fixtures.

Change-Id: I38596faa833c770757bcf91131d99a72e8868d21
Co-developed-by: Qoder CLI &lt;noreply@qoder.com&gt;
diff --git a/apps/webui/src/lib/view/artifact.test.ts b/apps/webui/src/lib/view/artifact.test.ts
@@ -233,9 +233,9 @@ describe("extractArtifacts", () => {
 			"",
 			"```html",
 			"<!DOCTYPE html>",
-			'<link rel="preconnect" href="https://fonts.googleapis.com">',
-			'<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>',
-			'<link href="https://fonts.googleapis.com/css2?family=Inter" rel="stylesheet">',
+			'<link rel="preconnect" href="https://cdn.example.test">',
+			'<link rel="preconnect" href="https://assets.example.test" crossorigin>',
+			'<link href="https://cdn.example.test/styles.css" rel="stylesheet">',
 			"```",
 			"",
 			"预览：https://preview.example.com/page",
@@ -357,7 +357,7 @@ describe("document extraction", () => {
 	test("URLs inside an extracted HTML document are NOT extracted as artifacts", () => {
 		const html = makeHtmlDocument().replace(
 			"</head>",
-			'<link href="https://fonts.googleapis.com/css2?family=Inter" rel="stylesheet"></head>',
+			'<link href="https://cdn.example.test/styles.css" rel="stylesheet"></head>',
 		);
 		const { segments } = extractArtifacts(html);
 		const artifacts = segments.filter((s) => s.type === "artifact" || s.type === "images");
@@ -370,16 +370,16 @@ describe("document extraction", () => {
 			"",
 			"```html",
 			"<!DOCTYPE html>",
-			'<link rel="preconnect" href="https://fonts.googleapis.com">',
-			'<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>',
-			'<link href="https://fonts.googleapis.com/css2?family=Inter" rel="stylesheet">',
+			'<link rel="preconnect" href="https://cdn.example.test">',
+			'<link rel="preconnect" href="https://assets.example.test" crossorigin>',
+			'<link href="https://cdn.example.test/styles.css" rel="stylesheet">',
 			"```",
 			"",
 			"预览：https://preview.example.com/page",
 		].join("\n");
 		const { segments } = extractArtifacts(input);
 		// The fenced block is too short to be a document — stays as text.
-		expect(segments.some((s) => s.type === "text" && s.content.includes("fonts.googleapis.com"))).toBe(true);
+		expect(segments.some((s) => s.type === "text" && s.content.includes("cdn.example.test"))).toBe(true);
 		expect(segments.every((s) => s.type !== "document")).toBe(true);
 	});
 
