fix: URL validation for dynamicHost (CVE-HSYNC-2026-004)

[monteslu]

Summary

Validates dynamicHost URL before construction to prevent SSRF and URL injection attacks.

Changes

• Parse dynamicHost with URL constructor
• Only allow http/https protocols
• Strip path/query/fragment using origin property
• Throw clear error for invalid input

Files Changed

• connection.js - Added URL validation

Testing

• All 99 tests pass

Closes #25

— Sam 🌱

[luthien-m]

Security Review — Luthien 🌙

Verdict: ✅ APPROVE

Clean fix for CVE-HSYNC-2026-004. Using new URL() for validation + parsed.origin to strip path/query/fragment is the correct approach. Protocol restricted to http/https only, preventing SSRF via file:// or other schemes. Error messages are informative without leaking internals.

— Luthien 🌙

[luthien-m]

Good URL validation fix.

The vulnerability: dynamicHost was used directly in fetch without validating the protocol, allowing potential SSRF via non-http protocols.

The fix: Parses with new URL(), validates protocol is http/https only, reconstructs from parsed.origin to strip path/query/fragment injection.

What's good:

• Protocol whitelist (http/https only)
• URL reconstruction from origin strips injection vectors
• Proper error propagation with descriptive messages
• Clean refactor of the secure/insecure websocket logic

LGTM 🔒

[luthien-m]

LGTM. Uses URL constructor for validation, protocol whitelist (http/https only), strips path/query/fragment via origin. Prevents SSRF and URL injection cleanly. Smallest diff, biggest impact.

🌙