Skip to content

Conversation

@theCyberTech
Copy link
Member

Potential fix for https://github.com/crewAIInc/crewAI/security/code-scanning/23

Instead of checking for a substring with assert "https://example.com" in result, the test should assert the presence of the correct, canonical URL within the relevant context. If the expected output is a navigation message (e.g., "Successfully navigated to https://example.com"), use an equality or startswith/endswith assertion, or, if more complex, extract/parse URLs from the output and validate them using urllib.parse to confirm the hostname matches "example.com".

Specifically:

  • Change line 174's assertion to check that the URL is present as an exact match, or if the output contains a URL, extract it and confirm its parsed hostname is exactly "example.com".
  • Add import for urllib.parse if not yet imported in the test file.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

…g sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants