fix(security): exact-host Anthropic baseUrl check (CodeQL #674)

[diegosouzapw]

CodeQL alert #674 — js/incomplete-url-substring-sanitization (high)

Location: open-sse/executors/default.ts (anthropic-compatible Bearer-fallback gate)

Problem

The check that decides whether a configured baseUrl targets the official api.anthropic.com host used a substring match:

baseUrl === "" || baseUrl.includes("api.anthropic.com")

A look-alike upstream like https://api.anthropic.com.evil.test or https://evil.test/?x=api.anthropic.com matches the substring and is wrongly treated as official, suppressing the Authorization: Bearer fallback that third-party Anthropic-compatible gateways require.

Fix

Replace it with an exported isOfficialAnthropicBaseUrl() helper that parses the URL and compares the hostname for exact equality (same house pattern used for the prior js/incomplete-url-substring-sanitization fixes #658/#659/#660):

• empty baseUrl → official (unchanged)
• scheme-less host (api.anthropic.com/v1) → parsed with assumed https://
• unparseable baseUrl → third-party (Bearer emitted), the safer default

Behavior for all legitimate official/third-party baseUrls is unchanged.

Tests (Rule #18 TDD)

tests/unit/anthropic-official-baseurl-host.test.ts — official / look-alike / scheme-less / unparseable inputs + a static guard asserting the substring pattern is gone (RED→GREEN regression guard).

Validation

• node --test new suite: 4/4 ✅
• npm run typecheck:core: clean ✅
• eslint (changed files): clean ✅

Closes the alert on main after merge + JS/TS re-scan. Cherry-picked to release/v3.8.38 in a follow-up PR.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Code Review

This pull request addresses a CodeQL security vulnerability by replacing a substring-based check for the official Anthropic host with a robust hostname-based validation using the URL API, and adds comprehensive unit tests. The review feedback recommends enhancing the robustness of the new isOfficialAnthropicBaseUrl function to handle non-string inputs and trim leading/trailing whitespaces, as well as expanding the test suite to cover these edge cases.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Robustness and Defensive Programming in isOfficialAnthropicBaseUrl

Currently, isOfficialAnthropicBaseUrl assumes baseUrl is always a string and does not trim leading or trailing whitespaces. If baseUrl contains leading/trailing spaces (e.g., " api.anthropic.com "), the new URL constructor will throw on both attempts, incorrectly treating it as a third-party host.

Furthermore, since credentials is implicitly typed as any in buildHeaders, baseUrl could potentially be a non-string at runtime (e.g., if providerSpecificData contains unexpected types). Calling .trim() or passing a non-string to new URL without a type guard could lead to runtime exceptions (e.g., TypeError).

We can make this function fully robust by:

1. Adding a runtime type check to ensure baseUrl is a string (returning true if falsy, and false if truthy but not a string).
2. Trimming the string to handle any accidental leading/trailing whitespaces.

export function isOfficialAnthropicBaseUrl(baseUrl: unknown): boolean {
  if (typeof baseUrl !== "string") {
    return !baseUrl;
  }
  const trimmed = baseUrl.trim();
  if (!trimmed) return true;
  let host: string | null = null;
  try {
    host = new URL(trimmed).hostname;
  } catch {
    try {
      host = new URL("https://" + trimmed).hostname;
    } catch {
      return false;
    }
  }
  return host === "api.anthropic.com";
}

[gemini-code-assist]

Add test cases for whitespace-padded inputs

To ensure that leading and trailing whitespaces are correctly handled and trimmed, we should add test cases for whitespace-padded inputs.

test("official endpoints are recognized (empty / scheme / scheme-less / path / whitespace)", () => {
  assert.equal(isOfficialAnthropicBaseUrl(""), true, "empty baseUrl = default official");
  assert.equal(isOfficialAnthropicBaseUrl("https://api.anthropic.com"), true);
  assert.equal(isOfficialAnthropicBaseUrl("https://api.anthropic.com/v1"), true);
  assert.equal(isOfficialAnthropicBaseUrl("https://api.anthropic.com/"), true);
  // scheme-less host (operator may omit the protocol) is parsed with an assumed https://
  assert.equal(isOfficialAnthropicBaseUrl("api.anthropic.com"), true);
  assert.equal(isOfficialAnthropicBaseUrl("api.anthropic.com/v1"), true);
  // whitespace-padded inputs
  assert.equal(isOfficialAnthropicBaseUrl("  https://api.anthropic.com  "), true);
  assert.equal(isOfficialAnthropicBaseUrl("  api.anthropic.com/v1  "), true);
});

[gemini-code-assist]

Add test cases for non-string inputs

To verify that non-string inputs are handled gracefully without throwing runtime exceptions, we should add test cases for them.

test("unparseable or non-string baseUrl falls back to third-party (Bearer emitted)", () => {
  assert.equal(isOfficialAnthropicBaseUrl("http://"), false);
  assert.equal(isOfficialAnthropicBaseUrl(":::"), false);
  assert.equal(isOfficialAnthropicBaseUrl(true as any), false);
  assert.equal(isOfficialAnthropicBaseUrl({} as any), false);
});

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.