Dev

[DarkNoah]

No description provided.

In general, the fix is to stop using substring checks on the raw URL string and instead parse the URL and compare its hostname (or host) to an explicit whitelist (here, github.com and optionally www.github.com). This ensures that github.com appearing in the path or query string does not cause the input to be treated as a GitHub URL.

For this specific code, the minimal change is:

• Parse gitUrl with the standard URL class inside the previewGitSkill method.
• Replace if (gitUrl.includes('github.com')) with a safe check on the parsed hostname, e.g. if (this.isGitHubUrl(gitUrl)), where isGitHubUrl uses new URL() and compares hostname to an allowlist (github.com, www.github.com).
• Add a small helper method private isGitHubUrl(rawUrl: string): boolean inside the same class (in src/main/tools/index.ts) that:
  • Tries new URL(rawUrl) inside a try/catch.
  • Returns true only when url.hostname strictly matches the allowed values.
  • Returns false on parse errors or non-HTTP(S) schemes.

This keeps all existing functionality (GitHub URLs still go through parseGitHubUrl, owner/repo strings still go through the other branch) while eliminating the substring-based decision. No external dependencies are needed; URL is built in to Node/Electron.

In general, the fix is to stop using substring checks like includes('github.com') on the full URL string and instead either (a) parse the URL and check its hostname equals github.com (or is on an explicit whitelist), or (b) if full host parsing is overkill here, at least ensure the string starts with an expected GitHub prefix such as https://github.com/ or http://github.com/. This avoids treating github.com appearing in the path, query, or in the middle of another host name as valid.

For this code path, the minimal, behavior‑preserving fix is to refine the branch condition to use prefix checks that indicate the URL is actually targeting GitHub: treat repo_or_url as a GitHub URL only if it starts with https://github.com/ or http://github.com/. The rest of the logic (calling this.parseGitHubUrl and constructing repoUrl/gitPath) can remain unchanged. This avoids breaking the shorthand "owner/repo" forms, which are still handled in the else branch. No new imports are strictly necessary; we can implement this using simple string methods.

Concretely, in src/main/tools/index.ts, around line 1144, replace:

if (repo_or_url.includes('github.com')) {

with a stricter check such as:

if (
  repo_or_url.startsWith('https://github.com/') ||
  repo_or_url.startsWith('http://github.com/')
) {

This ensures only genuine GitHub URLs go through the parseGitHubUrl path, and other inputs (including malformed or attacker-crafted strings containing github.com in the wrong place) fall through to the existing shorthand handling. No other lines in this file need changes for this particular issue.