microsoft
diff --git a/‎.gitignore‎
Lines changed: 4 additions & 0 deletions b/‎.gitignore‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎docs/reports/coverage-uplift-85.md‎
Lines changed: 1458 additions & 0 deletions b/‎docs/reports/coverage-uplift-85.md‎
Lines changed: 1458 additions & 0 deletions
diff --git a/‎src/Reactor/Hosting/Devtools/DevtoolsMcpServer.cs‎
Lines changed: 16 additions & 4 deletions b/‎src/Reactor/Hosting/Devtools/DevtoolsMcpServer.cs‎
Lines changed: 16 additions & 4 deletions
diff --git a/‎src/Reactor/Hosting/PreviewCaptureServer.cs‎
Lines changed: 18 additions & 4 deletions b/‎src/Reactor/Hosting/PreviewCaptureServer.cs‎
Lines changed: 18 additions & 4 deletions
diff --git a/‎src/Reactor/Markdown/MarkdownHtml.cs‎
Lines changed: 11 additions & 17 deletions b/‎src/Reactor/Markdown/MarkdownHtml.cs‎
Lines changed: 11 additions & 17 deletions
@@ -212,6 +212,10 @@ tests/stress_perf/publish_log*.txt
 # Cobertura reports are regenerated on demand and should never be committed.
 coverage/
 *.cobertura.xml
+# `tools/coverage/` holds source-controlled coverage helper scripts and is
+# NOT generated output; carve it out of the `coverage/` ignore above.
+!tools/coverage/
+!tools/coverage/**
 
 # Eval / scratch run output — local artifacts from eval drivers, never tracked.
 runs/
 
@@ -465,10 +465,22 @@ private bool IsAllowedHost(string? hostHeader)
 
     private static bool IsAllowedOrigin(string origin)
     {
-        if (origin.StartsWith("vscode-webview://", StringComparison.OrdinalIgnoreCase)) return true;
-        if (origin.StartsWith("http://127.0.0.1", StringComparison.Ordinal)) return true;
-        if (origin.StartsWith("http://localhost", StringComparison.OrdinalIgnoreCase)) return true;
-        return false;
+        // Parse via System.Uri rather than string-prefix matching. A
+        // StartsWith allow-list would let `http://localhost.evil.com` through
+        // because the malicious host genuinely starts with "localhost";
+        // Uri.TryCreate decomposes scheme/host correctly per RFC 3986.
+        if (!Uri.TryCreate(origin, UriKind.Absolute, out var uri))
+            return false;
+
+        if (string.Equals(uri.Scheme, "vscode-webview", StringComparison.OrdinalIgnoreCase))
+            return true;
+
+        // MCP traffic is HTTP only — no https:// arm (HttpListener binds to
+        // http://127.0.0.1:<port>, so an https origin would never originate
+        // from this server's own callers).
+        if (uri.Scheme != Uri.UriSchemeHttp) return false;
+
+        return uri.Host == "localhost" || uri.Host == "127.0.0.1";
     }
 
     // -- Dispatch ----------------------------------------------------------------
 
@@ -323,10 +323,24 @@ private bool IsAllowedHost(string? hostHeader)
 
     private static bool IsAllowedOrigin(string origin)
     {
-        if (origin.StartsWith("vscode-webview://", StringComparison.OrdinalIgnoreCase)) return true;
-        if (origin.StartsWith("http://127.0.0.1", StringComparison.Ordinal)) return true;
-        if (origin.StartsWith("http://localhost", StringComparison.OrdinalIgnoreCase)) return true;
-        if (origin.StartsWith("https://localhost", StringComparison.OrdinalIgnoreCase)) return true;
+        // Parse the Origin header through System.Uri rather than string-prefix
+        // matching. StartsWith-based allow-lists let `http://localhost.evil.com`
+        // through because the malicious host genuinely starts with "localhost";
+        // Uri.TryCreate decomposes scheme/host/port correctly per RFC 3986.
+        if (!Uri.TryCreate(origin, UriKind.Absolute, out var uri))
+            return false;
+
+        if (string.Equals(uri.Scheme, "vscode-webview", StringComparison.OrdinalIgnoreCase))
+            return true;
+
+        // Preserve the pre-refactor allow-list shape: http accepts both
+        // 127.0.0.1 and localhost, but https accepts only localhost. Don't
+        // collapse to a generic http-or-https rule — that would silently
+        // open `https://127.0.0.1` which the original code rejected.
+        if (uri.Scheme == Uri.UriSchemeHttp)
+            return uri.Host == "127.0.0.1" || uri.Host == "localhost";
+        if (uri.Scheme == Uri.UriSchemeHttps)
+            return uri.Host == "localhost";
         return false;
     }
 
 
@@ -89,23 +89,17 @@ internal static string SanitizeUrl(string url, bool unsafeAllowed)
     {
         if (unsafeAllowed) return url;
         if (string.IsNullOrEmpty(url)) return url;
-        // Relative URLs (no scheme) are safe; only absolute schemes need
-        // checking. Pull the scheme by hand because Uri.TryCreate is too
-        // lenient — it would parse `javascript:alert(1)` as a valid Uri.
-        int colon = url.IndexOf(':');
-        if (colon <= 0) return url; // no scheme = treat as path-relative
-        // Schemes per RFC 3986: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
-        for (int i = 0; i < colon; i++)
-        {
-            var c = url[i];
-            bool ok = (i == 0)
-                ? (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
-                : (c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')
-                    || (c >= '0' && c <= '9') || c == '+' || c == '-' || c == '.';
-            if (!ok) return url; // not a real scheme — treat as relative
-        }
-        var scheme = url[..colon];
-        return SafeUrlSchemes.Contains(scheme) ? url : "about:blank";
+
+        // Uri.TryCreate happily parses `javascript:alert(1)` as a valid
+        // absolute Uri — that's fine, because the allow-list filter on
+        // uri.Scheme below rejects it. The point is to use System.Uri's
+        // RFC 3986 scheme/host decomposition rather than hand-rolled
+        // string parsing, which is fragile and a known source of bypass
+        // bugs in URL sanitizers.
+        if (!Uri.TryCreate(url, UriKind.Absolute, out var uri))
+            return url; // Not absolute — treat as path-relative; safe.
+
+        return SafeUrlSchemes.Contains(uri.Scheme) ? url : "about:blank";
     }
 
     private sealed class HtmlRenderer