Potential fix for code scanning alert no. 43: Incomplete URL scheme check

[alienx5499]

Potential fix for https://github.com/alienx5499/SortVision/security/code-scanning/43

In general, the fix is to treat data: and vbscript: schemes the same way as javascript: when validating or filtering URLs that may come from untrusted or semi-untrusted sources. Any logic that excludes javascript: URLs from further processing should also exclude data: and vbscript: URLs.

Concretely in SortVision/tests/quality-assurance.mjs, modify the extractInternalPathsFromHtml function so that the scheme check on line 140:

if (href.startsWith('javascript:')) continue;

is extended to also skip data: and vbscript: links. To minimize behavioral changes and keep the intent clear, we can simply expand this if to include additional startsWith checks:

if (
  href.startsWith('javascript:') ||
  href.startsWith('data:') ||
  href.startsWith('vbscript:')
) continue;

This keeps the rest of the function intact and avoids altering any other logic or imports. No new helpers or imports are required; the change is local to this function and just broadens the set of schemes treated as non-navigational/executable.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
sortvision	Ready	Preview, Comment	Jan 26, 2026 3:40am

[Copilot]

Pull request overview

This PR addresses a security vulnerability (code scanning alert #43) by extending URL scheme validation in the quality assurance test suite to filter out potentially dangerous data: and vbscript: URL schemes alongside the existing javascript: scheme check.

Changes:

• Extended the URL scheme filtering in extractInternalPathsFromHtml to reject data: and vbscript: schemes in addition to javascript: schemes

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.