From ab5828ab945c1bf1ba12517b762a8ce933aa555d Mon Sep 17 00:00:00 2001
From: Atlas <epung0716@gmail.com>
Date: Tue, 31 Mar 2026 21:48:33 -0700
Subject: [PATCH] Potential fix for code scanning alert no. 16: Incomplete URL
 substring sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 docs-engine/src/docResolver.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/docs-engine/src/docResolver.ts b/docs-engine/src/docResolver.ts
index e7f638f..acd1cb7 100644
--- a/docs-engine/src/docResolver.ts
+++ b/docs-engine/src/docResolver.ts
@@ -134,7 +134,17 @@ export class DocResolver {
     private getCorpusGroupForIndexedSymbol(symbol: IndexedSymbolSummary): string | undefined {
         const root = symbol.package || symbol.name.split('.')[0] || '';
         const baseUrl = this.inventoryFetcher.getPackageBaseUrl(root) || this.inventoryFetcher.getPackageBaseUrl('builtins');
-        return baseUrl?.includes('docs.python.org') ? PYHOVER_PYTHON_STDLIB_CORPUS_GROUP : undefined;
+        if (!baseUrl) {
+            return undefined;
+        }
+
+        try {
+            const parsed = new URL(baseUrl);
+            return parsed.hostname === 'docs.python.org' ? PYHOVER_PYTHON_STDLIB_CORPUS_GROUP : undefined;
+        } catch {
+            // If baseUrl is not a valid URL, fall back to no special corpus group.
+            return undefined;
+        }
     }
 
     async buildPythonStdlibCorpus(