fix: properly sanitize github url

Author: ReenigneArcher

scripts/build-index.cjs

@@ -20,11 +20,17 @@ const MASTER_INDEX_VERSION = '0.1.0';
  * @returns {Promise<object|null>} Repository metadata or null if not available
  */
 async function fetchGitHubMetadata(repoUrl) {
-  if (!repoUrl?.includes('github.com')) {
+  if (!repoUrl) {
     return null;
   }
 
   try {
+    // Parse and validate the URL to prevent substring injection attacks
+    const url = new URL(repoUrl);
+    if (url.hostname !== 'github.com' && url.hostname !== 'www.github.com') {
+      return null;
+    }
+
     // Extract owner/repo from URL
     const match = new RegExp(/github\.com\/([^/]+)\/([^/]+)/).exec(repoUrl);
     if (!match) {