fix(ci): validate CI-supplied server URLs before building a link

GITHUB_SERVER_URL and CI_SERVER_URL were composed into the pull request link
verbatim, while the sibling repository URLs read from the same environment
already went through a scheme/netloc check. The result is sent to the API as a
diff scan's external_href, so route all of them through one validator.

Standard runners set these themselves, so this is defense in depth rather than a
live hole. An unusable value now falls back to github.com for GitHub; GitLab has
no public default host, so the link is dropped and the scan keeps its number.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

socketsecurity/core/pull_request.py

@@ -27,14 +27,28 @@ def parse_pull_request_number(value) -> int:
     return parsed if parsed > 0 else 0
 
 
+def _http_url(value: Optional[str]) -> Optional[str]:
+    """Return ``value`` if it is an http(s) URL with a host, else ``None``.
+
+    Every URL fragment read out of the CI environment goes through here before it
+    is composed into a link, because the result is sent to the API as a diff scan's
+    ``external_href``. Standard runners set these variables themselves, so this is
+    defense in depth rather than a live hole.
+    """
+    if not value:
+        return None
+    url = value.strip().rstrip("/")
+    parsed = urlparse(url)
+    return url if parsed.scheme in ("http", "https") and parsed.netloc else None
+
+
 def _repository_url(value: Optional[str]) -> Optional[str]:
     if not value:
         return None
     url = value.strip().rstrip("/")
     if url.endswith(".git"):
         url = url[:-4]
-    parsed = urlparse(url)
-    return url if parsed.scheme in ("http", "https") and parsed.netloc else None
+    return _http_url(url)
 
 
 def _github_number(env: Mapping[str, str]) -> int:
@@ -52,8 +66,11 @@ def _github_url(number: int, repo: Optional[str], env: Mapping[str, str]) -> Opt
     repository = env.get("GITHUB_REPOSITORY") or remote_path or repo
     if not repository or "/" not in repository:
         return None
-    server = env.get("GITHUB_SERVER_URL") or (f"https://{remote_host}" if remote_host else "")
-    server = (server or "https://github.com").rstrip("/")
+    server = (
+        _http_url(env.get("GITHUB_SERVER_URL"))
+        or (_http_url(f"https://{remote_host}") if remote_host else None)
+        or "https://github.com"
+    )
     return f"{server}/{repository.strip('/')}/pull/{number}"
 
 
@@ -62,8 +79,10 @@ def _gitlab_url(number: int, repo: Optional[str], env: Mapping[str, str]) -> Opt
     if not project_url:
         remote_host, remote_path = parse_git_remote(env.get("BUILDKITE_REPO"))
         project_path = env.get("CI_PROJECT_PATH") or remote_path or repo
-        server = env.get("CI_SERVER_URL") or (f"https://{remote_host}" if remote_host else "")
-        server = server.rstrip("/")
+        server = (
+            _http_url(env.get("CI_SERVER_URL"))
+            or (_http_url(f"https://{remote_host}") if remote_host else None)
+        )
         if server and project_path and "/" in project_path:
             project_url = f"{server}/{project_path.strip('/')}"
     return f"{project_url}/-/merge_requests/{number}" if project_url else None

tests/unit/test_pull_request_context.py

@@ -196,6 +196,50 @@ def test_buildkite_github_enterprise_host_is_taken_from_the_remote():
     assert context.url == "https://github.example.com/acme/widgets/pull/42"
 
 
+@pytest.mark.parametrize(
+    "server",
+    ["javascript:alert(1)", "notaurl", "ftp://example.com", "https://", ""],
+)
+def test_unusable_github_server_url_falls_back_to_the_default(server):
+    """The result becomes a diff scan's external_href, so validate before composing."""
+    context = resolve_pull_request_context(
+        "github",
+        "42",
+        "acme/widgets",
+        configured_explicit=True,
+        env={"GITHUB_SERVER_URL": server, "GITHUB_REPOSITORY": "acme/widgets"},
+    )
+
+    assert context.url == "https://github.com/acme/widgets/pull/42"
+
+
+@pytest.mark.parametrize("server", ["javascript:alert(1)", "notaurl", "ftp://example.com"])
+def test_unusable_gitlab_server_url_yields_no_link(server):
+    """GitLab has no public default host to fall back to, so the link is dropped."""
+    context = resolve_pull_request_context(
+        "gitlab",
+        "42",
+        "acme/widgets",
+        configured_explicit=True,
+        env={"CI_SERVER_URL": server, "CI_PROJECT_PATH": "acme/widgets"},
+    )
+
+    assert context.number == 42
+    assert context.url is None
+
+
+def test_self_hosted_server_urls_are_still_honored():
+    assert resolve_pull_request_context(
+        "github", "42", None, configured_explicit=True,
+        env={"GITHUB_SERVER_URL": "https://github.example.com", "GITHUB_REPOSITORY": "acme/widgets"},
+    ).url == "https://github.example.com/acme/widgets/pull/42"
+
+    assert resolve_pull_request_context(
+        "gitlab", "42", None, configured_explicit=True,
+        env={"CI_SERVER_URL": "http://gitlab.internal", "CI_PROJECT_PATH": "acme/platform/widgets"},
+    ).url == "http://gitlab.internal/acme/platform/widgets/-/merge_requests/42"
+
+
 def test_github_actions_environment_wins_over_the_checkout_remote():
     context = resolve_pull_request_context(
         "github",