From 9ee2e3c1279c25dcebbf413e47372a1dc3c52ad4 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Wed, 24 Jun 2026 19:49:07 -0400 Subject: [PATCH] fix(agent-team): clear CodeQL URL-substring alert in confluence client test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The host assertion used `url.startswith("https://seahaven.atlassian.net")`, which CodeQL flags (incomplete URL substring sanitization — a spoofed host like `...atlassian.net.evil.com` passes a prefix check). Parse the URL and compare scheme+netloc exactly instead. (PR #66 review finding.) --- agent-team/tests/test_confluence_client.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/agent-team/tests/test_confluence_client.py b/agent-team/tests/test_confluence_client.py index 1871c28..1453e06 100644 --- a/agent-team/tests/test_confluence_client.py +++ b/agent-team/tests/test_confluence_client.py @@ -296,7 +296,13 @@ def test_client_uses_injected_env_mapping() -> None: client = ConfluenceClient(http=http, env=env) fetched = client.get_page("100") assert fetched["version"]["number"] == 4 - assert http.calls[0]["url"].startswith("https://seahaven.atlassian.net") + # Assert the request host EXACTLY (scheme+netloc parsed), not a string prefix: + # a `.startswith("https://seahaven.atlassian.net")` check passes for a spoofed + # host like `https://seahaven.atlassian.net.evil.com` (CodeQL: incomplete URL + # substring sanitization). Compare the parsed components instead. + parts = _urlparse.urlsplit(http.calls[0]["url"]) + assert (parts.scheme, parts.netloc) == ("https", "seahaven.atlassian.net") + assert parts.path.startswith("/wiki/api/v2/pages/100") # --------------------------------------------------------------------------- #