fix(word-addin): hostname-anchored login detection in the demo recorders

↗ view on GitHub · Amalanand Muthukumaran · 2026-08-03 · 0cfd362d

WHY THIS MATTERS
CodeQL flagged both e2e-live recorder scripts with
js/incomplete-url-substring-sanitization (high): they decided "are we on
the Microsoft login page?" with url.includes("login.microsoftonline.com").
A substring test matches that string ANYWHERE in the URL - including
attacker-shaped hosts like login.microsoftonline.com.evil.test or benign
pages whose path merely embeds the domain - so it is not a safe way to
classify a URL's origin. These are local demo drivers, so the practical
risk is low, but the pattern is exactly what the rule exists to catch and
scripts get copied.

HOW THE FIX WORKS
Parse the URL and compare its HOSTNAME: exact match or a dot-anchored
suffix (hostname === domain || hostname.endsWith("." + domain)) against
the two real login hosts. The login-mode wait loop keeps its "don't
re-navigate while the user is typing" behavior via the same helper plus a
case-insensitive signup check.
Repository open-legal-products/mike
Author Amalanand Muthukumaran <mamalanand3@gmail.com>
Authored
Committed
Parents aa234ba9
Stats 2 files changed , +35 , -5
Part of Add a Word add-in for chat and tracked rewrites

Capture this commit into my fork

Download a Markdown prompt that tells Claude how to port this exact commit into your working tree. Run it via claude -p < capture-commit-0cfd362d.md from inside the repo you want the change in.

⬇ Download capture-commit-0cfd362d.md