Fix incomplete URL substring sanitization for Azure blob storage check (CodeQL #92)

[Copilot]

Plain substring matching on an unparsed URL can be trivially bypassed — e.g. https://attacker.com/evil?.blob.core.windows.net would pass the old check. Fixes the high-severity CodeQL alert py/incomplete-url-substring-sanitization.

Overview

Replaces the unsafe substring check for Azure blob storage URLs with proper urlparse-based hostname validation.

JIRA

N/A — security alert fix

Changes

• Imports urllib.parse.urlparse in interactive_session.py
• Replaces '.blob.core.windows.net' in link_path_str with urlparse(link_path_str).hostname.endswith('.blob.core.windows.net'), scoping the check to the actual hostname component only

# Before (bypassable)
if link_path_str.startswith('https://') and '.blob.core.windows.net' in link_path_str:

# After (safe)
_parsed_url = urlparse(link_path_str)
_is_azure_https = (
    _parsed_url.scheme == 'https'
    and (_parsed_url.hostname or '').endswith('.blob.core.windows.net')
)
if link_path_str.startswith('az://') or _is_azure_https:

Acceptance Criteria

Scenario 1 - Azure blob URL is correctly rejected

A valid Azure blob URL such as `https://myaccount.blob.core.windows.net/container/file` raises `ValueError`.

Scenario 2 - Bypass attempt is rejected

A crafted URL such as `https://attacker.com/path?.blob.core.windows.net` does **not** trigger the Azure check (hostname is `attacker.com`, not a `.blob.core.windows.net` host).

DEV

Proof this feature/patch works in this environment

AZURE

Proof this feature/patch works in this environment

Interactive Analysis

Proof this feature/patch works in this environment