From 5ca1ecfce6bcf131f95dc60c2f0d88b82646b644 Mon Sep 17 00:00:00 2001
From: 3252a8 <3252a8@proton.me>
Date: Wed, 10 Jun 2026 23:09:38 +0300
Subject: [PATCH] test: parse installer download host instead of substring
 check

Extract the raw_url() template from install.sh and compare the parsed
hostname to raw.githubusercontent.com. Resolves the CodeQL "incomplete
URL substring sanitization" alert on the old substring assertion.
---
 tests/test_install_script.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/test_install_script.py b/tests/test_install_script.py
index 8de03a0..4c876d8 100644
--- a/tests/test_install_script.py
+++ b/tests/test_install_script.py
@@ -1,6 +1,8 @@
+import re
 import shutil
 import subprocess
 from pathlib import Path
+from urllib.parse import urlsplit
 
 import pytest
 
@@ -33,7 +35,9 @@ def test_shell_installer_downloads_raw_files_and_runs_import_in_container():
     script = INSTALL_SCRIPT.read_text(encoding="utf-8")
 
     assert script.startswith("#!/bin/sh")
-    assert "raw.githubusercontent.com" in script
+    raw_url_template = re.search(r"printf '(https://[^']+)' \"\$repo\"", script)
+    assert raw_url_template is not None
+    assert urlsplit(raw_url_template.group(1)).hostname == "raw.githubusercontent.com"
     assert "git clone" not in script
     assert "backend python backend/scripts/import_legacy.py" in script
     assert "Optional source Remnashop .env path" in script