Updates

[sirdeggen]

No description provided.

In general, instead of treating URLs as plain strings and checking for substrings, parse and examine their components or, when dealing with known constant identifiers, compare for exact equality. For the W3C VC context, the specification expects the exact context URL https://www.w3.org/2018/credentials/v1 to be present in the @context array. That means the robust fix is to ensure that at least one element is exactly equal to VC_CONTEXT, not that some element merely contains it as a substring.

Concretely, in src/modules/credentials.ts, line 288 currently uses vc['@context'].includes(VC_CONTEXT). This is an array includes, which already checks exact equality on each element, but CodeQL is flagging this because it treats VC_CONTEXT as a URL and is conservative about substring‑style checks. To make the intent explicit and resilient, we can (a) ensure @context is treated as an array, (b) search for an exact match, and (c) avoid any substring logic. The cleanest, non‑functional change is to check that some context entry equals VC_CONTEXT using Array.prototype.some with strict equality. That keeps behavior the same (exact match required) but makes it explicit and should address the sanitizer warning.

No new imports or helper methods are required. Only the condition around the context check needs to be updated in verify, and we should add a small guard in case vc['@context'] isn’t an array, without altering existing logic for valid cases.