fix(security): constrain GitHub URL matches

Author: morluto

internal/clustering/clustering_test.go

@@ -112,6 +112,8 @@ func TestExtractRefs(t *testing.T) {
 		{"see #42 for context", 1},
 		{"fix owner/repo#7", 1},
 		{"https://github.com/owner/repo/issues/3", 1},
+		{"see github.com/owner/repo/pull/4", 1},
+		{"https://notgithub.com/owner/repo/issues/3", 0},
 		{"nothing here", 0},
 	}
 

internal/clustering/fingerprint.go

@@ -78,7 +78,7 @@ var (
 	// Matches owner/repo#123 or owner/repo #123 (issue or pull-request number).
 	repoIssueRefPattern = regexp.MustCompile(`(?i)([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)/([a-z0-9_.-]+)\s*#\s*(\d+)`)
 	// Matches github.com/owner/repo/issues/123 or pull/123.
-	urlRefPattern = regexp.MustCompile(`(?i)github\.com/([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)/([a-z0-9_.-]+)/(?:issues|pull)/(\d+)`)
+	urlRefPattern = regexp.MustCompile(`(?i)(?:^|[^a-z0-9.-])(?:https?://)?(?:www\.)?github\.com/([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)/([a-z0-9_.-]+)/(?:issues|pull)/(\d+)`)
 	// Matches bare #123 in body or title, constrained to word boundaries.
 	bareRefPattern = regexp.MustCompile(`(?:^|\s|\W)#\s*(\d+)(?:\b|$)`)
 )