fix: address Copilot review round 12 findings

- Install packaging explicitly in both validate workflow jobs so
  PEP 440 validation is consistent across runner images
- Restrict parse_issue_body() to only split on known form labels,
  preventing user-typed ### headings in textareas from corrupting
  field parsing
- Restrict URL reachability checks to GitHub domains only (github.com,
  raw.githubusercontent.com, etc.) to mitigate DNS-rebinding TOCTOU
  risks — issue templates already require GitHub URLs
- Validate, deduplicate, and sort preset requires.extensions IDs
  using the same ID regex, ensuring clean catalog output

Author: mnriem

.github/scripts/catalog-validate.py

@@ -35,26 +35,33 @@
 # Issue body parser
 # ---------------------------------------------------------------------------
 
-def parse_issue_body(body: str) -> dict[str, str]:
+def parse_issue_body(body: str, known_labels: set[str] | None = None) -> dict[str, str]:
     """Parse a GitHub issue form body into {label: value} pairs.
 
     GitHub issue forms render as markdown with ``### Label`` headers
     followed by the user's input.  Checkbox groups render as lists of
     ``- [X]`` / ``- [ ]`` items.
+
+    When *known_labels* is provided, only ``### Label`` lines whose text
+    matches a known label start a new field.  Other ``###`` headings
+    inside textarea content are preserved as-is.
     """
     fields: dict[str, str] = {}
     current_label: str | None = None
     current_lines: list[str] = []
 
     for line in body.splitlines():
         if line.startswith("### "):
-            # Store previous field
-            if current_label is not None:
-                fields[current_label] = "\n".join(current_lines).strip()
-            current_label = line[4:].strip()
-            current_lines = []
-        else:
-            current_lines.append(line)
+            heading = line[4:].strip()
+            # Only split on known form labels (if provided)
+            if known_labels is None or heading in known_labels:
+                # Store previous field
+                if current_label is not None:
+                    fields[current_label] = "\n".join(current_lines).strip()
+                current_label = heading
+                current_lines = []
+                continue
+        current_lines.append(line)
 
     # Don't forget the last field
     if current_label is not None:
@@ -295,6 +302,17 @@ def check_url_reachable(
     hostname = parsed.hostname
     if not hostname:
         return False, f"{field_name} URL has no hostname."
+
+    # Restrict to known hosts to mitigate DNS-rebinding TOCTOU risks
+    _allowed_hosts = {
+        "github.com", "www.github.com", "codeload.github.com",
+        "raw.githubusercontent.com", "objects.githubusercontent.com",
+    }
+    if hostname not in _allowed_hosts:
+        return False, (
+            f"{field_name} URL must be on a GitHub domain "
+            f"(got `{hostname}`)."
+        )
     try:
         addr_info = socket.getaddrinfo(hostname, None)
         for _family, _type, _proto, _canonname, sockaddr in addr_info:
@@ -764,9 +782,11 @@ def _build_preset_entry(
         for line in extensions_raw.splitlines():
             line = line.strip().lstrip("-*").strip()
             for part in line.split(","):
-                part = part.strip()
-                if part:
+                part = part.strip().lower()
+                if part and _ID_RE.match(part):
                     ext_list.append(part)
+        # Deduplicate and sort for stable catalog output
+        ext_list = sorted(set(ext_list))
         if ext_list:
             requires["extensions"] = ext_list
     elif is_update and "extensions" in existing.get("requires", {}):
@@ -936,7 +956,8 @@ def main() -> None:
         catalog = json.load(f)
 
     # Parse and normalize
-    raw_fields = parse_issue_body(issue_body)
+    known_labels = set(LABEL_MAPS[args.type].keys())
+    raw_fields = parse_issue_body(issue_body, known_labels=known_labels)
     fields = normalize_fields(raw_fields, args.type)
 
     if not fields:

.github/workflows/catalog-validate.yml

@@ -22,6 +22,9 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Install dependencies
+        run: pip install packaging
+
       - name: Validate submission
         id: validate
         env:
@@ -140,6 +143,9 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Install dependencies
+        run: pip install packaging
+
       - name: Validate submission
         id: validate
         env: