fix(security): close CodeQL alert #11 (incomplete URL substring sanitization in sample mock-fetch)

[voyvodka]

Summary

Closes CodeQL alert #11 (HIGH severity, js/incomplete-url-substring-sanitization) on samples/portal-host/src/mock-fetch.ts:117.

The previous shape:

if (!url.startsWith(BASE)) return originalFetch(input, init);

with BASE = "https://hooks.example.com". The startsWith check correctly catches paths like https://hooks.example.com/api/v1/portal/endpoints, but it ALSO matches https://hooks.example.com.attacker.com/api/v1/portal/endpoints — the BASE prefix can be followed by an arbitrary host suffix. Fine for the sample's mock semantics in isolation (the worst case is the mock answers a request that should have gone to the real network), but the kind of pattern that absolutely should not get copy-pasted into production code.

Fix

Parse the URL and compare protocol + host explicitly via WHATWG URL:

const BASE_URL = new URL(BASE);
// ...
let parsed: URL;
try {
  parsed = new URL(url);
} catch {
  return originalFetch(input, init);
}
if (parsed.protocol !== BASE_URL.protocol || parsed.host !== BASE_URL.host) {
  return originalFetch(input, init);
}

Same intent, no substring trap. Also flipped path = url.slice(BASE.length).split("?")[0] → path = parsed.pathname which is the same value via a safer route. Route handlers downstream are unchanged.

Test plan

• No behavior change for the sample's actual use (mocks serve the same routes for the same inputs)
• CI green
• CodeQL alert refactor(validators): centralize endpoint URL policy and allow HTTP in development #11 closes after merge