Potential fix for code scanning alert no. 16: Incomplete URL substring sanitization

[KiidxAtlas]

Potential fix for https://github.com/KiidxAtlas/python-hover/security/code-scanning/16

In general, the problem should be fixed by parsing the URL and examining its host or hostname component instead of doing a plain substring match on the full URL string. The host comparison should be explicit, ideally against an allowlist, and allow for exact host matches (and, if desired, specific known subdomains) instead of any occurrence of the string anywhere in the URL.

For this specific case, we should replace baseUrl?.includes('docs.python.org') with a check that parses baseUrl using Node’s standard URL class and inspects the hostname. Since the code appears to want to detect the official Python documentation, we should treat URLs whose hostname is exactly docs.python.org or a known subdomain like docs.python.org (and possibly docs.python.org. but that’s unusual). To avoid changing surrounding behavior, we only adjust the condition: compute a boolean isPythonStdlibDocs by attempting to construct a URL from baseUrl. If parsing fails, or baseUrl is falsy, we return undefined (current behavior). If parsing succeeds, we check url.hostname === 'docs.python.org'. This yields the same true results for properly formed official-docs URLs and avoids accidental matches where docs.python.org is in some other part of the URL string.

Concretely, in docs-engine/src/docResolver.ts, inside getCorpusGroupForIndexedSymbol, replace the line using .includes('docs.python.org') with a small parsed-URL based check. We can safely use the global URL constructor available in modern Node without adding imports. No other functions or files need changes.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ab5828a.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[Copilot]

Pull request overview

This PR addresses code scanning alert #16 by replacing an unsafe substring match on a documentation base URL with a parsed-URL hostname check, preventing unintended matches where docs.python.org appears outside the host component.

Changes:

• Replaced baseUrl?.includes('docs.python.org') with new URL(baseUrl).hostname === 'docs.python.org'.
• Added explicit handling for missing/invalid baseUrl values (returning undefined as before).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.