Potential fix for code scanning alert no. 2: Incomplete URL substring sanitization

[jonathansantilli]

Potential fix for https://github.com/jonathansantilli/codegate/security/code-scanning/2

In general, to avoid incomplete URL substring sanitization when checking for allowed domains, you must compare the parsed hostname against an explicit, well-formed whitelist. To allow a base domain and any of its subdomains, you should accept either an exact match to the base domain, or a hostname that ends with . + base domain. This prevents unwanted hosts like evilgitlab.com or gitlab.com.evil.com from matching.

For this specific code, the intent of isLikelyGitSource is to detect URLs that point to common Git hosting providers. We can replace the three endsWith checks with a small helper that tests for “hostname is exactly X or has X as a suffix after a dot”. Since we must not change imports or assume extra context, we can implement this helper locally in the same file, just above isLikelyGitSource, and then call it three times. This preserves existing functionality (detects base domains and subdomains such as api.github.com) while eliminating the possibility that foo-github.com or github.com.evil.net incorrectly match.

Concretely:

• Add a hasHostSuffix(hostname: string, baseDomain: string): boolean helper that:
  • Lowercases both inputs.
  • Returns true if hostname === baseDomain or hostname.endsWith("." + baseDomain).
• Change the return expression in isLikelyGitSource (lines 585–589) to call this helper instead of directly using endsWith("...").

No external libraries are needed; the URL type and string operations are already available.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.