Potential fix for code scanning alert no. 2: Incomplete URL substring sanitization

[zaxlofful]

Potential fix for https://github.com/zaxlofful/SimpleWish/security/code-scanning/2

In general, to fix this kind of problem you should parse the URL and inspect its host (and path), instead of checking for substrings like 'github.com' in url. For GitHub URLs, this means using urllib.parse.urlparse (or similar) to get parsed.hostname and compare it to github.com (or an allowlist), and then examining parsed.path for /actions/workflows/.

For this specific code in scripts/render_readme.py, the best targeted fix is:

• Parse img_url using urllib.parse.urlparse.
• Require that parsed.hostname is exactly github.com (case‑insensitive). This avoids accepting URLs like https://notgithub.com/... or https://evil.com/github.com/....
• Check that parsed.path contains /actions/workflows/ in the expected position, rather than using a substring on the full URL.
• Replace the condition on line 159 with one that uses these parsed components, while keeping the rest of the behavior (deriving wf_basename, alt_name, and building workflow_link) unchanged.

Concretely:

• Add from urllib.parse import urlparse to the imports at the top of scripts/render_readme.py.

• In standalone_repl, replace the condition

  if img_url and 'github.com' in img_url and '/actions/workflows/' in img_url and img_parsed == (owner.lower(), repo.lower()):

  with logic that:

  • Parses img_url into parsed = urlparse(img_url).
  • Computes host = (parsed.hostname or "").lower() and path = parsed.path or "".
  • Checks host == 'github.com' and '/actions/workflows/' in path along with the existing img_parsed == (owner.lower(), repo.lower()).

No changes to other files or behavior are necessary.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	simplewish	0d0060f	Feb 03 2026, 05:46 AM

[Copilot]

Pull request overview

This PR addresses a security vulnerability (code scanning alert #2) related to incomplete URL substring sanitization in the README badge rendering script. The fix replaces simple substring checks with proper URL parsing to validate GitHub Actions badge URLs.

Changes:

• Added urlparse import from urllib.parse for proper URL parsing
• Updated the standalone_repl function to use urlparse to extract and validate hostname and path components instead of substring matching

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The URL parsing logic can be simplified. The if-else structure (lines 160-166) is redundant because line 167 already checks "if img_url". When img_url is empty, parsing it would still work safely and result in empty host and path values, causing the condition on line 167 to fail naturally. Consider simplifying to: parsed = urlparse(img_url) if img_url else urlparse(''); host = (parsed.hostname or '').lower(); path = parsed.path or ''. This reduces nesting and makes the code more readable.

Suggested change

	if img_url:
	parsed = urlparse(img_url)
	host = (parsed.hostname or '').lower()
	path = parsed.path or ''
	else:
	host = ''
	path = ''
	parsed = urlparse(img_url) if img_url else urlparse('')
	host = (parsed.hostname or '').lower()
	path = parsed.path or ''

[Copilot]

Variable host is not used.

Suggested change

	if img_url:
	parsed = urlparse(img_url)
	host = (parsed.hostname or '').lower()
	path = parsed.path or ''
	else:
	host = ''
	path = ''
	host = ''
	path = ''
	if img_url:
	parsed = urlparse(img_url)
	host = (parsed.hostname or '').lower()
	path = parsed.path or ''

[Copilot]

Variable path is not used.

Suggested change

	if img_url:
	parsed = urlparse(img_url)
	host = (parsed.hostname or '').lower()
	path = parsed.path or ''
	else:
	host = ''
	path = ''
	host = ''
	path = ''
	if img_url:
	parsed = urlparse(img_url)
	host = (parsed.hostname or '').lower()
	path = parsed.path or ''