From 733ac43172b7daa3f0d017a9f952a7f8e25893c0 Mon Sep 17 00:00:00 2001 From: yusufipk Date: Thu, 30 Jul 2026 19:33:19 +0700 Subject: [PATCH] test(api): match the bunny host instead of a substring of the url CodeQL flags the substring form (js/incomplete-url-substring-sanitization) because a host check on an unparsed url matches when the host appears anywhere in it. Nothing untrusted reaches this recorder, but a loose match could still record a delete aimed elsewhere as a Bunny delete and pass an assertion for the wrong reason. --- tests/api/expired-billing-cleanup.test.ts | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/tests/api/expired-billing-cleanup.test.ts b/tests/api/expired-billing-cleanup.test.ts index 01d1989..750bfe1 100644 --- a/tests/api/expired-billing-cleanup.test.ts +++ b/tests/api/expired-billing-cleanup.test.ts @@ -27,12 +27,16 @@ beforeEach(() => { vi.stubGlobal( 'fetch', vi.fn(async (url: string | URL, init?: { method?: string }) => { - const href = typeof url === 'string' ? url : url.toString(); - if (init?.method === 'DELETE' && href.includes('video.bunnycdn.com')) { - bunnyDeletes.push(href.split('/videos/')[1] ?? ''); + // Matched on the parsed host rather than a substring of the href, so a request to some + // other service that merely mentions the Bunny host cannot be recorded as a Bunny + // delete. The recorder decides what the assertions see, so a loose match here would + // make a test pass for the wrong reason. + const target = new URL(typeof url === 'string' ? url : url.toString()); + if (init?.method === 'DELETE' && target.host === 'video.bunnycdn.com') { + bunnyDeletes.push(target.pathname.split('/videos/')[1] ?? ''); return new Response(null, { status: 200 }); } - throw new Error(`Unexpected fetch in test: ${init?.method ?? 'GET'} ${href}`); + throw new Error(`Unexpected fetch in test: ${init?.method ?? 'GET'} ${target.href}`); }) ); });