Correct the single high CodeQL alert inherited by the desktop transport epic from commit d75cda981c9f5baba06504a4949ad9a7aa7d50bf. Target only branch 1953-epic-desktop-transport-api; do not target or merge to main, and do not modify existing child PRs #1989, #2023, or #2025.
Scope the implementation to apps/desktop/src/credential-service.test.ts unless a tiny test helper is essential. At the current assertion near line 658, replace request.url.startsWith('https://attacker.example.test') with URL parsing and exact .origin equality. Define one fixed attacker origin and reuse it for the probe URL and filtering. Keep the authorization non-forwarding assertion, and make it explicitly non-vacuous by proving at least one attacker-origin request was observed before asserting every such request has authorization === null.
This is a test/mock correctness fix, not a production URL-policy change. Do not weaken, dismiss, suppress, or baseline the js/incomplete-url-substring-sanitization alert. Add a focused negative assertion if useful to prove lookalike hosts such as attacker.example.test.evil.invalid do not match the exact origin. Run the focused credential-service tests, desktop tests/typecheck, git diff --check, and CodeQL. Keep the PR narrowly scoped and report the exact changed files.
Correct the single high CodeQL alert inherited by the desktop transport epic from commit
d75cda981c9f5baba06504a4949ad9a7aa7d50bf. Target only branch1953-epic-desktop-transport-api; do not target or merge tomain, and do not modify existing child PRs #1989, #2023, or #2025.Scope the implementation to
apps/desktop/src/credential-service.test.tsunless a tiny test helper is essential. At the current assertion near line 658, replacerequest.url.startsWith('https://attacker.example.test')with URL parsing and exact.originequality. Define one fixed attacker origin and reuse it for the probe URL and filtering. Keep the authorization non-forwarding assertion, and make it explicitly non-vacuous by proving at least one attacker-origin request was observed before asserting every such request hasauthorization === null.This is a test/mock correctness fix, not a production URL-policy change. Do not weaken, dismiss, suppress, or baseline the
js/incomplete-url-substring-sanitizationalert. Add a focused negative assertion if useful to prove lookalike hosts such asattacker.example.test.evil.invaliddo not match the exact origin. Run the focused credential-service tests, desktop tests/typecheck,git diff --check, and CodeQL. Keep the PR narrowly scoped and report the exact changed files.