From 293abf5b5640193ad6ba43b4f4a81b7cbd0d2d88 Mon Sep 17 00:00:00 2001 From: Eduard van Valkenburg Date: Tue, 18 Nov 2025 23:16:58 +0100 Subject: [PATCH] Python: fix for Incomplete URL substring sanitization (#2274) * Potential fix for code scanning alert no. 29: Incomplete URL substring sanitization Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Python: Fix URL parsing to handle trailing punctuation in deployment progress detection (#2296) * Initial plan * Fix URL parsing to handle trailing punctuation correctly Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com> * updated lock --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: eavanvalkenburg <13749212+eavanvalkenburg@users.noreply.github.com> Co-authored-by: Victor Dibia --- .../devui/agent_framework_devui/_deployment.py | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/python/packages/devui/agent_framework_devui/_deployment.py b/python/packages/devui/agent_framework_devui/_deployment.py index e1cf1d5c3d..45f99a315a 100644 --- a/python/packages/devui/agent_framework_devui/_deployment.py +++ b/python/packages/devui/agent_framework_devui/_deployment.py @@ -10,6 +10,7 @@ import uuid from collections.abc import AsyncGenerator from datetime import datetime, timezone from pathlib import Path +from urllib.parse import urlparse from .models._discovery_models import Deployment, DeploymentConfig, DeploymentEvent @@ -467,11 +468,18 @@ CMD ["devui", "/app/entity", "--mode", "{config.ui_mode}", "--host", "0.0.0.0", await event_queue.put( DeploymentEvent(type="deploy.progress", message=f"Docker build: {line_text}") ) - elif "https://" in line_text and ".azurecontainerapps.io" in line_text: - # Deployment URL detected - await event_queue.put( - DeploymentEvent(type="deploy.progress", message="Deployment URL generated!") - ) + elif "https://" in line_text: + # Try to extract all URLs and check if any is on azurecontainerapps.io + urls = re.findall(r'https://[^\s<>"]+', line_text) + for url in urls: + # Strip common trailing punctuation to ensure clean URL parsing + url_clean = url.rstrip(".,;:!?'\")}]") + host = urlparse(url_clean).hostname + if host and (host == "azurecontainerapps.io" or host.endswith(".azurecontainerapps.io")): + await event_queue.put( + DeploymentEvent(type="deploy.progress", message="Deployment URL generated!") + ) + break # Wait for process to complete return_code = await process.wait()