Potential fix for code scanning alert no. 23: Incomplete URL substring sanitization

[Tanker187]

Potential fix for https://github.com/Tanker187/stagehand/security/code-scanning/23

In general, to fix incomplete URL substring sanitization, you should parse the URL and compare its host (or hostname) against an expected value or whitelist, instead of checking substrings on the entire URL string. This prevents cases where the target domain appears in the path, query, or as part of another hostname.

For this specific test, we want to assert that the loaded page is https://example.com (or at least that its host is exactly example.com). The best minimal fix is to parse pageUrl using the standard URL class (available in Node and browsers) and assert on url.hostname === "example.com". This avoids sloppy substring matching while preserving the semantics that the test expects.

Concretely:

• In packages/server/test/integration/v3/navigate.test.ts, replace the assert.ok(pageUrl.includes("example.com"), ...) line with logic that:
  • Creates a URL from pageUrl.
  • Asserts that parsed.hostname === "example.com".
• Wrap the parsing in a small try/catch or rely on the test failing naturally if pageUrl is invalid; given this is a controlled test, the simple use of new URL(pageUrl) is sufficient.
• No new imports are needed; URL is a global in Node 18+ and modern environments.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.