From 5a3af1bab9eb8850082dfb1453da4206fe35fdae Mon Sep 17 00:00:00 2001
From: Random Guy <50927468+M03ED@users.noreply.github.com>
Date: Thu, 25 Sep 2025 13:56:18 +0330
Subject: [PATCH] Potential fix for code scanning alert no. 2: Incomplete URL
 substring sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 app/models/validators.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/app/models/validators.py b/app/models/validators.py
index e1e93375f..027f1e9e6 100644
--- a/app/models/validators.py
+++ b/app/models/validators.py
@@ -2,6 +2,7 @@
 from datetime import datetime
 from decimal import Decimal
 from typing import Optional
+from urllib.parse import urlparse
 
 from app.db.models import UserStatusCreate
 
@@ -173,8 +174,11 @@ def validate_proxy_url(value: str | None) -> str | None:
 class DiscordValidator:
     @staticmethod
     def validate_webhook(value: str | None):
-        if value and not value.startswith("https://discord.com"):
-            raise ValueError("Discord webhook must start with 'https://discord.com'")
+        if value:
+            parsed = urlparse(value)
+            # validate scheme and hostname
+            if parsed.scheme != "https" or parsed.hostname not in {"discord.com"}:
+                raise ValueError("Discord webhook must use https scheme and point to 'discord.com'")
         return value