Potential fix for code scanning alert no. 1: Incomplete URL substring sanitization

[GitTimeraider]

Potential fix for https://github.com/GitTimeraider/GithubBackup-docker/security/code-scanning/1

The best way to fix this problem is to properly parse the repo_url using Python's urllib.parse module and then check that the hostname is exactly github.com (or possibly ends with .github.com if subdomains are allowed, but for GitHub repositories, only github.com is valid). This ensures that only URLs genuinely pointing to GitHub are accepted, and not URLs that merely contain github.com as a substring elsewhere. The code in verify_github_access should be updated to use urlparse to extract the hostname and path, and only proceed if the hostname is exactly github.com. The extraction of owner and repo name should also be updated to use the parsed path, not a string split on 'github.com/'.

Required changes:

• Add an import for urlparse from urllib.parse if not already present.
• In verify_github_access, use urlparse to parse repo_url.
• Check that the parsed hostname is exactly github.com.
• Extract the owner and repo name from the parsed path, ensuring the path is of the form /owner/repo(.git)?.
• Update the logic accordingly.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a security vulnerability by fixing incomplete URL substring sanitization in the repository URL validation. The fix ensures that only genuine GitHub URLs are accepted by properly parsing the URL structure rather than relying on substring checks.

• Replaces unsafe substring check with proper URL parsing using urlparse
• Validates that the hostname is exactly github.com instead of checking for substring presence
• Updates path parsing logic to extract owner/repo from parsed URL components

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

The hostname check should also validate the scheme to ensure it's HTTPS. URLs with 'http://' scheme or no scheme could be security risks. Consider adding parsed.scheme == 'https' to the condition.

Suggested change

	# Path is of the form /owner/repo(.git)? or /owner/repo/
	if parsed.scheme == 'https' and parsed.hostname and parsed.hostname.lower() == "github.com":
	# Path is of the form /owner/repo(.git)? or /owner/repo/

[Copilot]

The path validation should be more strict. Currently it accepts paths with more than 2 parts (e.g., '/owner/repo/extra/parts'), which may not be valid GitHub repository URLs. Consider checking for exactly 2 parts or validating that additional parts are acceptable (like '/tree/branch').

[Copilot]

The owner and repository name should be validated to ensure they contain only valid characters. GitHub usernames and repository names have specific character restrictions (alphanumeric, hyphens, underscores, periods). Consider adding validation to prevent injection attacks.