fix(security): resolve high CodeQL sanitizer findings

src/approval_ledger.py

@@ -124,7 +124,7 @@ def _campaign_fingerprint(packet: dict[str, Any]) -> str:
         "action_ids": sorted(str(item.get("action_id") or "") for item in (packet.get("actions") or [])),
         "top_repos": sorted(str(item) for item in (packet.get("top_repos") or [])),
     }
-    return hashlib.sha1(json.dumps(material, sort_keys=True).encode("utf-8")).hexdigest()
+    return hashlib.sha256(json.dumps(material, sort_keys=True).encode("utf-8")).hexdigest()
 
 
 def _automation_eligible_action_count(packet: dict[str, Any]) -> int:
@@ -704,7 +704,7 @@ def build_approval_followup_record(
     cadence_days: int = DEFAULT_FOLLOW_UP_CADENCE_DAYS,
 ) -> dict[str, Any]:
     reviewed_at = datetime.now(timezone.utc).isoformat()
-    event_id = hashlib.sha1(
+    event_id = hashlib.sha256(
         "|".join(
             [
                 str(ledger_record.get("approval_id") or ""),

src/portfolio_truth_sources.py

@@ -5,6 +5,7 @@
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
+from urllib.parse import urlparse
 
 from src.notion_registry import load_notion_project_context
 from src.portfolio_catalog import group_entry_for_path
@@ -415,10 +416,11 @@ def _extract_github_full_name(remote_url: str) -> str:
         cleaned = cleaned[:-4]
     if cleaned.startswith("[email protected]:"):
         cleaned = cleaned.split("[email protected]:", 1)[1]
-    elif "github.com/" in cleaned:
-        cleaned = cleaned.split("github.com/", 1)[1]
     else:
-        return ""
+        parsed = urlparse(cleaned)
+        if parsed.hostname != "github.com":
+            return ""
+        cleaned = parsed.path.lstrip("/")
     parts = [part for part in cleaned.split("/") if part]
     if len(parts) < 2:
         return ""

tests/test_badge_export.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import json
+from urllib.parse import parse_qs, urlparse
 
 from src.badge_export import (
     _endpoint_badge_url,
@@ -83,8 +84,11 @@ def test_space_encoding(self):
 
     def test_endpoint_url(self):
         url = _endpoint_badge_url("https://example.com/badge.json")
-        assert url.startswith("https://img.shields.io/endpoint?url=")
-        assert "example.com" in url
+        parsed = urlparse(url)
+        assert parsed.scheme == "https"
+        assert parsed.netloc == "img.shields.io"
+        assert parsed.path == "/endpoint"
+        assert parse_qs(parsed.query)["url"] == ["https://example.com/badge.json"]
 
 
 class TestExportBadges:

tests/test_github_client_async.py

@@ -5,6 +5,7 @@
 import asyncio
 import threading
 import time
+from urllib.parse import urlparse
 
 import httpx
 import pytest
@@ -89,7 +90,11 @@ def handler(request: httpx.Request) -> httpx.Response:
         transport = httpx.MockTransport(handler)
         fetch_enrichment_sync([("alice", "repo")], _transport=transport)
 
-        paths = [u.split("api.github.com")[1] for u in called_urls if "api.github.com" in u]
+        paths = [
+            parsed.path
+            for u in called_urls
+            if (parsed := urlparse(u)).hostname == "api.github.com"
+        ]
         assert any("/repos/alice/repo/community/profile" in p for p in paths)
         assert any("/repos/alice/repo/languages" in p for p in paths)
         assert any("/repos/alice/repo/releases" in p for p in paths)

tests/test_portfolio_truth.py

@@ -17,7 +17,7 @@
 from src.portfolio_truth_publish import publish_portfolio_truth
 from src.portfolio_truth_reconcile import build_portfolio_truth_snapshot
 from src.portfolio_truth_render import render_registry_markdown
-from src.portfolio_truth_sources import _classify_context_quality
+from src.portfolio_truth_sources import _classify_context_quality, _extract_github_full_name
 from src.registry_parser import parse_registry
 
 
@@ -34,6 +34,12 @@ def _set_mtime(path: Path, timestamp: float) -> None:
     os.utime(path, (timestamp, timestamp))
 
 
+def test_extract_github_full_name_uses_exact_github_host() -> None:
+    assert _extract_github_full_name("https://github.com/octo/repo.git") == "octo/repo"
+    assert _extract_github_full_name("[email protected]:octo/repo.git") == "octo/repo"
+    assert _extract_github_full_name("https://evil.example/github.com/octo/repo.git") == ""
+
+
 @pytest.fixture
 def portfolio_workspace(tmp_path: Path) -> Path:
     workspace = tmp_path / "workspace"

tests/test_vuln_check.py

@@ -112,10 +112,8 @@ def fake_post(url, json, timeout):
 
         assert captured_body
         queries = captured_body[0]["queries"]
-        ecosystems = [q["package"]["ecosystem"] for q in queries]
-        assert "npm" in ecosystems
-        assert "PyPI" in ecosystems
-        assert "crates.io" in ecosystems
+        ecosystems = {q["package"]["ecosystem"] for q in queries}
+        assert {"npm", "PyPI", "crates.io"}.issubset(ecosystems)
 
     def test_api_error_returns_empty(self, capsys) -> None:
         audit = _make_audit("repo", [("requests", "2.0", "pypi")])