Potential fix for code scanning alert no. 4: Incomplete URL substring sanitization

[mixtapejaxson]

Potential fix for https://github.com/mixtapejaxson/ChatTweak/security/code-scanning/4

To fix the problem, the URL must be parsed and the relevant components—typically origin, host, or path—checked explicitly.

• For the Spotlight blocker, instead of checking if urlString.includes(SPOTLIGHT_URL), parse the URL and compare its origin and pathname to the intended Spotlight endpoint.
• Only block the request if both the origin matches https://web.snapchat.com and the path starts with /context/spotlight (or equals, depending on desired strictness).
• The best way is to use the standard URL Web API to parse urlString. This is available in all modern browsers and in Node, so it does not require any extra packages.
• Apply the same approach for the fetch override in case the same check is done elsewhere.
• Imports are not needed since URL is global, but wrap parsing in a try/catch to ensure malformed URLs don’t cause crashes.

Only lines within src/script/modules/telemetry-blocker/index.ts need changes, specifically the conditional on line 106. Show several lines of context on each side, and add new code only as required by the fix.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[mixtapejaxson]

@appelmoesgg Can you review this for me?

Jaxson

[appelmoesgg]

Hello,

Can you check what i sent on telegram?

Thx

[mixtapejaxson]

@appelmoesgg hey! Recently I have lost my my phone so I do not have access to telegram for the time being. Please email me for the time being at [email protected]

Thank you!

[appelmoesgg]

ok i'll just copy paste it:

So the thing with the url parsing is like, is it really necesarry? Cuz copilot mentions CSRF and malicious hosts, but the script already only loads on web.snapchat.com and i dont think snapchat will send requests with that in an extra part...

Hope you find your phone soon :)