fix(security): Whitelist bypass vulnerability

- Fixed URL whitelist to use proper domain boundary matching - Added WhitelistTest.kt with 6 test cases - Added IMPROVEMENTS.md with code review notes Security fix identified by Spirit 👻 Co-authored-by: Spirit <spirit@hobbs.farm> Co-authored-by: Margaret <margaret@hobbs.farm>
2026-02-03 09:11:06 -06:00
parent 6dc1a73d2e
commit 4f2430d354
3 changed files with 111 additions and 2 deletions
@@ -128,8 +128,9 @@ class MainActivity : AppCompatActivity() {
    }

    private fun isUrlAllowed(url: String): Boolean {
-        return whitelist.any { domain -> 
-            url.contains(domain, ignoreCase = true) 
+        val host = android.net.Uri.parse(url).host?.lowercase() ?: return false
+        return whitelist.any { domain ->
+            host == domain || host.endsWith(".$domain")
        }
    }