fix(word-addin): hostname-anchored login detection in the demo recorders
WHY THIS MATTERS
CodeQL flagged both e2e-live recorder scripts with
js/incomplete-url-substring-sanitization (high): they decided "are we on
the Microsoft login page?" with url.includes("login.microsoftonline.com").
A substring test matches that string ANYWHERE in the URL - including
attacker-shaped hosts like login.microsoftonline.com.evil.test or benign
pages whose path merely embeds the domain - so it is not a safe way to
classify a URL's origin. These are local demo drivers, so the practical
risk is low, but the pattern is exactly what the rule exists to catch and
scripts get copied.
HOW THE FIX WORKS
Parse the URL and compare its HOSTNAME: exact match or a dot-anchored
suffix (hostname === domain || hostname.endsWith("." + domain)) against
the two real login hosts. The login-mode wait loop keeps its "don't
re-navigate while the user is typing" behavior via the same helper plus a
case-insensitive signup check.
| Repository | open-legal-products/mike |
|---|---|
| Author | Amalanand Muthukumaran <mamalanand3@gmail.com> |
| Authored | |
| Committed | |
| Parents | aa234ba9 |
| Stats | 2 files changed , +35 , -5 |
| Part of | Add a Word add-in for chat and tracked rewrites |
Capture this commit into my fork
Download a Markdown prompt that tells Claude how to port this
exact commit into your working tree. Run it via
claude -p < capture-commit-0cfd362d.md
from inside the repo you want the change in.