Kikobeats / url-http / 31020737822

100%

main: 100%

push

github

fix: reject invalid hosts matched via path substrings (#31)

* fix: reject invalid hosts matched via path substrings

When exact matching is disabled for IPv6/punycode URLs, url-regex-safe
can match a URL-looking substring in the path while the authority itself
is not a valid HTTP host. Stop treating text fragments as unanchored, and
require the origin to match whenever matching is unanchored.

Co-authored-by: kikohumanbeatbox <kikohumanbeatbox@gmail.com>

* refactor: reuse one compiled regex for both match passes

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MTbj6CYXGsk6rhXx7J8SUP

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: kikohumanbeatbox <kikohumanbeatbox@gmail.com>
Co-authored-by: Kiko Beats <josefrancisco.verdu@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

20 of 20 branches covered (100.0%)

Branch coverage included in aggregate %.

13 of 13 new or added lines in 1 file covered. (100.0%)

43 of 43 relevant lines covered (100.0%)

19.07 hits per line