From 45aed0843dd6546a4000bf8caf6bbcfc4350b97c Mon Sep 17 00:00:00 2001
From: jeffrey701 <jeffreyconradtucker@gmail.com>
Date: Sun, 5 Jul 2026 13:57:39 -0400
Subject: [PATCH] feat(enrichment): allowlist 0.0.0.0 in the hardcoded-URL
 analyzer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ALLOWLISTED_HOSTS treated localhost/127.0.0.1/example.com as placeholders but
not 0.0.0.0, the unspecified/localhost bind address — so `http://0.0.0.0:PORT`
(a dev/bind placeholder, not a real endpoint) was flagged as a hardcoded URL.
Adds it + extends the allowlist test.
---
 .../src/analyzers/hardcoded-url.ts            | 291 +++++++++---------
 review-enrichment/test/hardcoded-url.test.ts  | 178 +++++------
 2 files changed, 238 insertions(+), 231 deletions(-)

diff --git a/review-enrichment/src/analyzers/hardcoded-url.ts b/review-enrichment/src/analyzers/hardcoded-url.ts
index c5790d50ba..a4ea3d1d07 100644
--- a/review-enrichment/src/analyzers/hardcoded-url.ts
+++ b/review-enrichment/src/analyzers/hardcoded-url.ts
@@ -1,143 +1,148 @@
-// Hardcoded-URL / raw-endpoint analyzer (#2027). Flags absolute HTTP(S) URLs and IP:port endpoints newly
-// added in non-test, non-config source — often environment leakage or a value that should come from config.
-// Distinct from the secret scanner (no credential); this is a portability/config-hygiene signal. Pure compute
-// over added lines, no network. Hostnames are redacted/truncated in findings — never full paths or queries.
-import type { EnrichRequest, HardcodedUrlFinding } from "../types.js";
-import { isMagicNumberSourcePath } from "./magic-number.js";
-
-const MAX_FINDINGS = 25;
-const MAX_LINE_CHARS = 2000;
-const MAX_HOST_CHARS = 40;
-
-const CONFIG_PATH_RE =
-  /(?:^|\/)(?:docker-compose[^/]*\.ya?ml|compose[^/]*\.ya?ml|values(?:\.[^/]+)?\.ya?ml|\.env(?:\.[^/]+)?|.*\.(?:tf|tfvars|hcl|ya?ml|json|toml|ini|conf|env)|Dockerfile(?:\.[^/]+)?|nginx[^/]*\.conf)$/i;
-
-const HTTP_URL_RE = /https?:\/\/[^\s'"\`<>]+/gi;
-const IP_ENDPOINT_RE = /\b(?:\d{1,3}\.){3}\d{1,3}:\d{1,5}\b/g;
-
-const ALLOWLISTED_HOSTS = new Set(["localhost", "127.0.0.1", "example.com"]);
-
-function isConfigPath(path: string): boolean {
-  return CONFIG_PATH_RE.test(path);
-}
-
-function isScannablePath(path: string): boolean {
-  return isMagicNumberSourcePath(path) && !isConfigPath(path);
-}
-
-function redactHost(host: string): string {
-  const lower = host.toLowerCase();
-  if (lower.length <= MAX_HOST_CHARS) return lower;
-  return `${lower.slice(0, MAX_HOST_CHARS - 3)}...`;
-}
-
-function isAllowlistedHost(host: string): boolean {
-  const lower = host.toLowerCase();
-  if (ALLOWLISTED_HOSTS.has(lower)) return true;
-  if (lower.endsWith(".example.com")) return true;
-  return false;
-}
-
-function hostFromHttpUrl(url: string): string {
-  const match = /^https?:\/\/([^/?#:]+)(?::\d+)?/i.exec(url);
-  return match?.[1] ?? url;
-}
-
-function isCommentLine(line: string): boolean {
-  const trimmed = line.trimStart();
-  return /^(?:\/\/|#|\/\*|\*|<!--)/.test(trimmed);
-}
-
-function isImportLine(line: string): boolean {
-  const trimmed = line.trimStart();
-  return /^(?:import\b|from\b|#include\b|require\s*\(|use\s+\w+::)/.test(trimmed);
-}
-
-/** Classify one added line for a hardcoded URL or IP endpoint, or null. Pure. */
-export function detectHardcodedUrl(
-  line: string,
-): { kind: HardcodedUrlFinding["kind"]; host: string } | null {
-  if (isCommentLine(line) || isImportLine(line)) return null;
-
-  HTTP_URL_RE.lastIndex = 0;
-  const urlMatch = HTTP_URL_RE.exec(line);
-  if (urlMatch) {
-    const host = hostFromHttpUrl(urlMatch[0]);
-    if (!isAllowlistedHost(host)) {
-      return { kind: "http-url", host: redactHost(host) };
-    }
-  }
-
-  IP_ENDPOINT_RE.lastIndex = 0;
-  const ipMatch = IP_ENDPOINT_RE.exec(line);
-  if (ipMatch) {
-    const host = ipMatch[0].split(":")[0] ?? ipMatch[0];
-    if (!isAllowlistedHost(host)) {
-      return { kind: "ip-endpoint", host: redactHost(host) };
-    }
-  }
-
-  return null;
-}
-
-type ScanLimits = {
-  maxFindings?: number;
-  signal?: AbortSignal;
-};
-
-/** Scan one file patch's added lines for hardcoded URLs/endpoints, line-cited via hunk headers. Pure. */
-export function scanPatchForHardcodedUrl(
-  path: string,
-  patch: string,
-  limits: ScanLimits = {},
-): HardcodedUrlFinding[] {
-  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
-  if (maxFindings <= 0 || !isScannablePath(path)) return [];
-  const findings: HardcodedUrlFinding[] = [];
-  let newLine = 0;
-  let inHunk = false;
-  for (const line of patch.split("\n")) {
-    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
-    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
-    if (hunk) {
-      newLine = Number(hunk[1]);
-      inHunk = true;
-      continue;
-    }
-    if (!inHunk) continue;
-    if (line.startsWith("+")) {
-      const body = line.slice(1);
-      if (body.length <= MAX_LINE_CHARS) {
-        const hit = detectHardcodedUrl(body);
-        if (hit) {
-          findings.push({ file: path, line: newLine, kind: hit.kind, host: hit.host });
-          if (findings.length >= maxFindings) return findings;
-        }
-      }
-      newLine++;
-    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
-      newLine++;
-    }
-  }
-  return findings;
-}
-
-/** Analyzer entrypoint: scan every changed scannable file's added lines for hardcoded endpoints. */
-export async function scanHardcodedUrl(
-  req: EnrichRequest,
-  signal?: AbortSignal,
-): Promise<HardcodedUrlFinding[]> {
-  const findings: HardcodedUrlFinding[] = [];
-  for (const file of req.files ?? []) {
-    if (signal?.aborted) throw new Error("analyzer_aborted");
-    if (!file.patch) continue;
-    for (const finding of scanPatchForHardcodedUrl(file.path, file.patch, {
-      maxFindings: MAX_FINDINGS - findings.length,
-      signal,
-    })) {
-      findings.push(finding);
-      if (findings.length >= MAX_FINDINGS) return findings;
-    }
-  }
-  return findings;
-}
+// Hardcoded-URL / raw-endpoint analyzer (#2027). Flags absolute HTTP(S) URLs and IP:port endpoints newly
+// added in non-test, non-config source — often environment leakage or a value that should come from config.
+// Distinct from the secret scanner (no credential); this is a portability/config-hygiene signal. Pure compute
+// over added lines, no network. Hostnames are redacted/truncated in findings — never full paths or queries.
+import type { EnrichRequest, HardcodedUrlFinding } from "../types.js";
+import { isMagicNumberSourcePath } from "./magic-number.js";
+
+const MAX_FINDINGS = 25;
+const MAX_LINE_CHARS = 2000;
+const MAX_HOST_CHARS = 40;
+
+const CONFIG_PATH_RE =
+  /(?:^|\/)(?:docker-compose[^/]*\.ya?ml|compose[^/]*\.ya?ml|values(?:\.[^/]+)?\.ya?ml|\.env(?:\.[^/]+)?|.*\.(?:tf|tfvars|hcl|ya?ml|json|toml|ini|conf|env)|Dockerfile(?:\.[^/]+)?|nginx[^/]*\.conf)$/i;
+
+const HTTP_URL_RE = /https?:\/\/[^\s'"\`<>]+/gi;
+const IP_ENDPOINT_RE = /\b(?:\d{1,3}\.){3}\d{1,3}:\d{1,5}\b/g;
+
+const ALLOWLISTED_HOSTS = new Set([
+  "localhost",
+  "127.0.0.1",
+  "0.0.0.0",
+  "example.com",
+]);
+
+function isConfigPath(path: string): boolean {
+  return CONFIG_PATH_RE.test(path);
+}
+
+function isScannablePath(path: string): boolean {
+  return isMagicNumberSourcePath(path) && !isConfigPath(path);
+}
+
+function redactHost(host: string): string {
+  const lower = host.toLowerCase();
+  if (lower.length <= MAX_HOST_CHARS) return lower;
+  return `${lower.slice(0, MAX_HOST_CHARS - 3)}...`;
+}
+
+function isAllowlistedHost(host: string): boolean {
+  const lower = host.toLowerCase();
+  if (ALLOWLISTED_HOSTS.has(lower)) return true;
+  if (lower.endsWith(".example.com")) return true;
+  return false;
+}
+
+function hostFromHttpUrl(url: string): string {
+  const match = /^https?:\/\/([^/?#:]+)(?::\d+)?/i.exec(url);
+  return match?.[1] ?? url;
+}
+
+function isCommentLine(line: string): boolean {
+  const trimmed = line.trimStart();
+  return /^(?:\/\/|#|\/\*|\*|<!--)/.test(trimmed);
+}
+
+function isImportLine(line: string): boolean {
+  const trimmed = line.trimStart();
+  return /^(?:import\b|from\b|#include\b|require\s*\(|use\s+\w+::)/.test(trimmed);
+}
+
+/** Classify one added line for a hardcoded URL or IP endpoint, or null. Pure. */
+export function detectHardcodedUrl(
+  line: string,
+): { kind: HardcodedUrlFinding["kind"]; host: string } | null {
+  if (isCommentLine(line) || isImportLine(line)) return null;
+
+  HTTP_URL_RE.lastIndex = 0;
+  const urlMatch = HTTP_URL_RE.exec(line);
+  if (urlMatch) {
+    const host = hostFromHttpUrl(urlMatch[0]);
+    if (!isAllowlistedHost(host)) {
+      return { kind: "http-url", host: redactHost(host) };
+    }
+  }
+
+  IP_ENDPOINT_RE.lastIndex = 0;
+  const ipMatch = IP_ENDPOINT_RE.exec(line);
+  if (ipMatch) {
+    const host = ipMatch[0].split(":")[0] ?? ipMatch[0];
+    if (!isAllowlistedHost(host)) {
+      return { kind: "ip-endpoint", host: redactHost(host) };
+    }
+  }
+
+  return null;
+}
+
+type ScanLimits = {
+  maxFindings?: number;
+  signal?: AbortSignal;
+};
+
+/** Scan one file patch's added lines for hardcoded URLs/endpoints, line-cited via hunk headers. Pure. */
+export function scanPatchForHardcodedUrl(
+  path: string,
+  patch: string,
+  limits: ScanLimits = {},
+): HardcodedUrlFinding[] {
+  const maxFindings = limits.maxFindings ?? MAX_FINDINGS;
+  if (maxFindings <= 0 || !isScannablePath(path)) return [];
+  const findings: HardcodedUrlFinding[] = [];
+  let newLine = 0;
+  let inHunk = false;
+  for (const line of patch.split("\n")) {
+    if (limits.signal?.aborted) throw new Error("analyzer_aborted");
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      newLine = Number(hunk[1]);
+      inHunk = true;
+      continue;
+    }
+    if (!inHunk) continue;
+    if (line.startsWith("+")) {
+      const body = line.slice(1);
+      if (body.length <= MAX_LINE_CHARS) {
+        const hit = detectHardcodedUrl(body);
+        if (hit) {
+          findings.push({ file: path, line: newLine, kind: hit.kind, host: hit.host });
+          if (findings.length >= maxFindings) return findings;
+        }
+      }
+      newLine++;
+    } else if (!line.startsWith("-") && !line.startsWith("\\")) {
+      newLine++;
+    }
+  }
+  return findings;
+}
+
+/** Analyzer entrypoint: scan every changed scannable file's added lines for hardcoded endpoints. */
+export async function scanHardcodedUrl(
+  req: EnrichRequest,
+  signal?: AbortSignal,
+): Promise<HardcodedUrlFinding[]> {
+  const findings: HardcodedUrlFinding[] = [];
+  for (const file of req.files ?? []) {
+    if (signal?.aborted) throw new Error("analyzer_aborted");
+    if (!file.patch) continue;
+    for (const finding of scanPatchForHardcodedUrl(file.path, file.patch, {
+      maxFindings: MAX_FINDINGS - findings.length,
+      signal,
+    })) {
+      findings.push(finding);
+      if (findings.length >= MAX_FINDINGS) return findings;
+    }
+  }
+  return findings;
+}
diff --git a/review-enrichment/test/hardcoded-url.test.ts b/review-enrichment/test/hardcoded-url.test.ts
index d16029803b..9650f50e1b 100644
--- a/review-enrichment/test/hardcoded-url.test.ts
+++ b/review-enrichment/test/hardcoded-url.test.ts
@@ -1,88 +1,90 @@
-// Units for the hardcoded-URL analyzer (#2027). Own file so concurrent analyzer PRs don't collide.
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import {
-  detectHardcodedUrl,
-  scanHardcodedUrl,
-  scanPatchForHardcodedUrl,
-} from "../dist/analyzers/hardcoded-url.js";
-import { renderBrief } from "../dist/render.js";
-
-const patchOf = (lines: string[]) =>
-  `@@ -1,0 +1,${lines.length} @@\n${lines.map((l) => `+${l}`).join("\n")}`;
-
-test("detectHardcodedUrl: flags absolute HTTP(S) URLs and IP:port endpoints", () => {
-  assert.deepEqual(detectHardcodedUrl(`const base = "https://api.prod.example.org/v1";`), {
-    kind: "http-url",
-    host: "api.prod.example.org",
-  });
-  assert.deepEqual(detectHardcodedUrl("await fetch('http://10.0.0.5:8080/health');"), {
-    kind: "http-url",
-    host: "10.0.0.5",
-  });
-  assert.deepEqual(detectHardcodedUrl("db.connect('192.168.0.12:5432')"), {
-    kind: "ip-endpoint",
-    host: "192.168.0.12",
-  });
-});
-
-test("detectHardcodedUrl: allowlists localhost, 127.0.0.1, and example.com", () => {
-  assert.equal(detectHardcodedUrl("fetch('http://localhost:3000')"), null);
-  assert.equal(detectHardcodedUrl("fetch('http://127.0.0.1:8080')"), null);
-  assert.equal(detectHardcodedUrl("fetch('https://api.example.com/v1')"), null);
-  assert.equal(detectHardcodedUrl("fetch('https://docs.staging.example.com')"), null);
-});
-
-test("detectHardcodedUrl: skips comment and import lines", () => {
-  assert.equal(detectHardcodedUrl("// docs: https://evil.example.net/guide"), null);
-  assert.equal(detectHardcodedUrl("import config from 'https://cdn.example.net/schema.json'"), null);
-  assert.equal(detectHardcodedUrl("# see https://evil.example.net"), null);
-});
-
-test("scanPatchForHardcodedUrl: flags added lines with correct locations", () => {
-  const findings = scanPatchForHardcodedUrl(
-    "src/client.ts",
-    patchOf([
-      "export async function load() {",
-      "  return fetch('https://billing.internal.example/v1');",
-      "}",
-    ]),
-  );
-  assert.deepEqual(findings, [
-    { file: "src/client.ts", line: 2, kind: "http-url", host: "billing.internal.example" },
-  ]);
-});
-
-test("scanPatchForHardcodedUrl: skips test and config files", () => {
-  assert.deepEqual(
-    scanPatchForHardcodedUrl("src/widget.test.ts", patchOf(["fetch('https://evil.example.net')"])),
-    [],
-  );
-  assert.deepEqual(
-    scanPatchForHardcodedUrl("config/settings.yml", patchOf(["url: https://evil.example.net"])),
-    [],
-  );
-});
-
-test("scanPatchForHardcodedUrl: respects the findings cap", () => {
-  const lines = Array.from({ length: 30 }, (_, i) => `fetch('https://host${i}.example.net');`);
-  assert.equal(scanPatchForHardcodedUrl("src/a.ts", patchOf(lines), { maxFindings: 3 }).length, 3);
-});
-
-test("scanHardcodedUrl: aggregates across files and renders in the brief", async () => {
-  const findings = await scanHardcodedUrl({
-    files: [
-      { path: "src/a.ts", patch: patchOf(["fetch('https://api.evil.example.net');"]) },
-      { path: "lib/db.py", patch: patchOf(["connect('10.1.2.3:5432')"]) },
-    ],
-  });
-  assert.deepEqual(findings, [
-    { file: "src/a.ts", line: 1, kind: "http-url", host: "api.evil.example.net" },
-    { file: "lib/db.py", line: 1, kind: "ip-endpoint", host: "10.1.2.3" },
-  ]);
-
-  const { promptSection } = renderBrief({ hardcodedUrl: findings });
-  assert.match(promptSection, /Hardcoded URLs\/endpoints/);
-  assert.match(promptSection, /src\/a\.ts:1/);
-  assert.match(promptSection, /lib\/db\.py:1/);
-});
+// Units for the hardcoded-URL analyzer (#2027). Own file so concurrent analyzer PRs don't collide.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  detectHardcodedUrl,
+  scanHardcodedUrl,
+  scanPatchForHardcodedUrl,
+} from "../dist/analyzers/hardcoded-url.js";
+import { renderBrief } from "../dist/render.js";
+
+const patchOf = (lines: string[]) =>
+  `@@ -1,0 +1,${lines.length} @@\n${lines.map((l) => `+${l}`).join("\n")}`;
+
+test("detectHardcodedUrl: flags absolute HTTP(S) URLs and IP:port endpoints", () => {
+  assert.deepEqual(detectHardcodedUrl(`const base = "https://api.prod.example.org/v1";`), {
+    kind: "http-url",
+    host: "api.prod.example.org",
+  });
+  assert.deepEqual(detectHardcodedUrl("await fetch('http://10.0.0.5:8080/health');"), {
+    kind: "http-url",
+    host: "10.0.0.5",
+  });
+  assert.deepEqual(detectHardcodedUrl("db.connect('192.168.0.12:5432')"), {
+    kind: "ip-endpoint",
+    host: "192.168.0.12",
+  });
+});
+
+test("detectHardcodedUrl: allowlists localhost, 127.0.0.1, and example.com", () => {
+  assert.equal(detectHardcodedUrl("fetch('http://localhost:3000')"), null);
+  assert.equal(detectHardcodedUrl("fetch('http://127.0.0.1:8080')"), null);
+  assert.equal(detectHardcodedUrl("fetch('https://api.example.com/v1')"), null);
+  assert.equal(detectHardcodedUrl("fetch('https://docs.staging.example.com')"), null);
+  // 0.0.0.0 is the unspecified/localhost bind address — a placeholder, not a real endpoint.
+  assert.equal(detectHardcodedUrl("fetch('http://0.0.0.0:8080')"), null);
+});
+
+test("detectHardcodedUrl: skips comment and import lines", () => {
+  assert.equal(detectHardcodedUrl("// docs: https://evil.example.net/guide"), null);
+  assert.equal(detectHardcodedUrl("import config from 'https://cdn.example.net/schema.json'"), null);
+  assert.equal(detectHardcodedUrl("# see https://evil.example.net"), null);
+});
+
+test("scanPatchForHardcodedUrl: flags added lines with correct locations", () => {
+  const findings = scanPatchForHardcodedUrl(
+    "src/client.ts",
+    patchOf([
+      "export async function load() {",
+      "  return fetch('https://billing.internal.example/v1');",
+      "}",
+    ]),
+  );
+  assert.deepEqual(findings, [
+    { file: "src/client.ts", line: 2, kind: "http-url", host: "billing.internal.example" },
+  ]);
+});
+
+test("scanPatchForHardcodedUrl: skips test and config files", () => {
+  assert.deepEqual(
+    scanPatchForHardcodedUrl("src/widget.test.ts", patchOf(["fetch('https://evil.example.net')"])),
+    [],
+  );
+  assert.deepEqual(
+    scanPatchForHardcodedUrl("config/settings.yml", patchOf(["url: https://evil.example.net"])),
+    [],
+  );
+});
+
+test("scanPatchForHardcodedUrl: respects the findings cap", () => {
+  const lines = Array.from({ length: 30 }, (_, i) => `fetch('https://host${i}.example.net');`);
+  assert.equal(scanPatchForHardcodedUrl("src/a.ts", patchOf(lines), { maxFindings: 3 }).length, 3);
+});
+
+test("scanHardcodedUrl: aggregates across files and renders in the brief", async () => {
+  const findings = await scanHardcodedUrl({
+    files: [
+      { path: "src/a.ts", patch: patchOf(["fetch('https://api.evil.example.net');"]) },
+      { path: "lib/db.py", patch: patchOf(["connect('10.1.2.3:5432')"]) },
+    ],
+  });
+  assert.deepEqual(findings, [
+    { file: "src/a.ts", line: 1, kind: "http-url", host: "api.evil.example.net" },
+    { file: "lib/db.py", line: 1, kind: "ip-endpoint", host: "10.1.2.3" },
+  ]);
+
+  const { promptSection } = renderBrief({ hardcodedUrl: findings });
+  assert.match(promptSection, /Hardcoded URLs\/endpoints/);
+  assert.match(promptSection, /src\/a\.ts:1/);
+  assert.match(promptSection, /lib\/db\.py:1/);
+});