fix: clear CodeQL incomplete URL substring sanitization alerts

[theCyberTech]

Summary

Fixes open CodeQL py/incomplete-url-substring-sanitization findings that still match on main, and unblocks CI flakes in tool-call streaming tests.

CodeQL fixes

1. DataTypes.from_content (lib/crewai-tools/src/crewai_tools/rag/data_types.py)
   • Replace "github.com" in url.netloc with hostname checks via urlparse.
2. Stagehand navigate test (lib/crewai-tools/tests/tools/stagehand_tool_test.py)
   • Replace URL substring assertion with exact mocked-result equality.
3. Tests for real vs spoofed GitHub hostnames.

CI flake fix

tests/llms/test_tool_call_streaming.py failed in CI with empty tool-call event lists (unrelated to the CodeQL changes). The emit mock only patched CrewAIEventsBus.emit on the class, which can be shadowed by an instance-level crewai_event_bus.emit. The fixture now patches both, and event extraction reads kwargs/args explicitly.

Validation

• Local CodeQL Incomplete URL substring sanitization: 0 results
• pytest lib/crewai-tools/tests/rag/test_data_types.py: 4 passed
• GITHUB_ACTIONS=true pytest lib/crewai/tests/llms/test_tool_call_streaming.py: 8 passed

  

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

The pull request tightens GitHub hostname detection and adds coverage for valid and spoofed URLs. It also strengthens Stagehand navigation assertions and makes streaming event tests handle both positional and keyword mock calls.

GitHub URL classification

Layer / File(s)	Summary
GitHub hostname detection and validation lib/crewai-tools/src/crewai_tools/rag/data_types.py, lib/crewai-tools/tests/rag/test_data_types.py	GitHub detection matches github.com and its subdomains case-insensitively. Tests reject spoofed hosts and GitHub-like paths.

Test assertion reliability

Layer / File(s)	Summary
Navigation result and invocation assertions lib/crewai-tools/tests/tools/stagehand_tool_test.py	The test verifies the complete mocked result and the exact _run call arguments.
Streaming event collection lib/crewai/tests/llms/test_tool_call_streaming.py	Streaming tests patch both event bus access paths and extract events from positional or keyword mock calls.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary CodeQL URL sanitization fix.
Description check	✅ Passed	The description accurately explains the CodeQL fixes, test updates, and validation results.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/fix-codeql-url-substring-c33e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@lib/crewai/tests/llms/test_tool_call_streaming.py`:
- Around line 55-60: Update _event_from_emit_call to return the first positional
argument when no keyword event exists, while preserving the existing
second-argument handling for bound calls. Add a test that patches
crewai_event_bus.emit and invokes it with a positional event, verifying both
collectors retain that event.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ab1b157e-3508-4a6a-9959-e9fc7e89c2a0

📥 Commits

Reviewing files that changed from the base of the PR and between 7bb690d and f0a7dcf.

📒 Files selected for processing (1)

• lib/crewai/tests/llms/test_tool_call_streaming.py

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.