Potential fix for code scanning alert no. 4: Incomplete URL substring sanitization

[h4p-t4p]

Potential fix for https://github.com/TechForPalestine/website/security/code-scanning/4

To fix the problem, we should parse the input URL using the URL constructor and check its host property, rather than using a substring search on the entire URL string. Specifically, in the conditional at lines 18–19, instead of notionUrl.includes("s3.us-west-2.amazonaws.com"), we should parse notionUrl and determine if its host is either s3.us-west-2.amazonaws.com or prod-files-secure.s3.amazonaws.com (since the second substring is ambiguous; we should check the actual canonical S3 host for Notion). This change must be robust to errors: if the URL is not valid, fallback behavior should be sane (e.g., treat as non-proxyable). All logic should reside inside getProxiedImageUrl. We may need to wrap the parse operation in a try/catch to avoid breaking if the URL is invalid.

No extra dependencies are needed; Node and browsers provide the global URL constructor.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[cloudflare-workers-and-pages]

Deploying website with    Cloudflare Pages

Latest commit:	d5d15db
Status:	✅  Deploy successful!
Preview URL:	https://2f7d3057.website-aun.pages.dev
Branch Preview URL:	https://alert-autofix-4.website-aun.pages.dev

View logs