Potential fix for code scanning alert no. 9: Server-side request forgery

[Saurav6200907210]

Potential fix for https://github.com/Saurav6200907210/Codexa/security/code-scanning/9

General fix: ensure all untrusted URL components used in outbound requests are constrained to expected formats and safely encoded, and enforce strict host allowlisting during URL parsing.

Best fix here (without changing functionality):

1. In src/lib/github.ts, strengthen parseRepoUrl:
   • Replace loose includes("github.com") with strict allowlist check (github.com, www.github.com).
   • Validate extracted owner and repo against GitHub-safe character regex (and non-empty).
2. In fetchRawFile (src/lib/github.ts):
   • Validate owner, repo, and branch with strict segment regex.
   • Reject dangerous path values (.., leading /, backslashes, empty segments).
   • Build URL using encodeURIComponent per segment to prevent traversal/ambiguity.
   • Return null for invalid inputs to preserve current failure behavior (function already returns null on failures).

No additional files are required for this fix.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[cloudflare-workers-and-pages]

Deploying codexaa with    Cloudflare Pages

Latest commit:	951c272
Status:	🚫  Build failed.

View logs