Fix URL security vulnerabilities (v1.2.2)

[oscarvalenzuelab]

Security Release v1.2.2

This PR fixes multiple URL security vulnerabilities in repository URL validation and construction.

Security Issues Fixed

1. URL Spoofing via Arbitrary Position String Matching

Vulnerable patterns:

if "github.com" in url:  # UNSAFE
if "git+" in url:        # UNSAFE

Attack examples:

• evil-github.com-fake.ru → matches "github.com" in url
• https://malicious.com?redirect=github.com/evil → matches domain check
• evil.com/git+malicious → matches "git+" in url

Fix: Use urlparse() to validate domain via netloc property

parsed = urlparse(url)
if parsed.netloc == "github.com":  # SAFE

2. URL Injection via Unsafe URL Construction

Vulnerable code:

if package_name.startswith("github.com/"):
    return f"https://{package_name}.git"  # UNSAFE

Attack examples:

• github.com/user/[email protected]/malicious
• github.com/../../etc/passwd
• github.com/user/repo#fragment?param=value

Fix: Validate input before URL construction

• Block dangerous characters: @, #, ?, &, whitespace
• Prevent path traversal: reject ..
• Whitelist safe characters: alphanumeric, /, -, _, .

Changes

src/ossval/parsers/spdx.py

✅ Add _is_git_url() helper method for safe URL validation
✅ Parse URLs and check domain via urlparse().netloc
✅ Check protocol prefixes with startswith() instead of in
✅ Fix 3 vulnerable checks in JSON and tag-value parsing

src/ossval/analyzers/repo_finder.py

✅ Fix _is_valid_git_url() to parse URLs and check netloc
✅ Fix _normalize_git_url() to safely check domains
✅ Fix _find_go_repo() with input validation
✅ Add dangerous character validation
✅ Add path traversal protection

src/ossval/core.py

✅ Fix GitHub health check to parse URL and validate netloc
✅ Replace unsafe in check with urlparse validation

Security Improvements

✅ All domain checks use urlparse().netloc == "domain.com"
✅ Protocol checks use startswith() instead of substring matching
✅ Input validation prevents malicious package names
✅ Path traversal attacks blocked
✅ Character whitelisting for URL construction

Testing

pytest tests/ -v
# 94 passed, 13 warnings in 8.10s

All existing tests pass. No functional regressions.

Impact

• Severity: Medium
• Attack vectors: URL spoofing, URL injection
• Affected versions: All versions prior to v1.2.2
• Mitigation: Proper URL parsing and input validation

Version Bump

• Version: 1.2.1 → 1.2.2
• CHANGELOG updated with security fix details