9d8d58ae75
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
#866 hardened the comment-persistence read-back into a full-path _belongs() check that pins scheme+host+port origin plus the full path, to block look-alike-host and same-host decoy-prefix attacks. That check compared the path case-sensitively: EXPECTED_REPO_SLUG is taken verbatim from GITEA_API_BASE and can be mixed-case (e.g. "USC/uconnect"), while Gitea canonicalizes the returned pull_request_url's owner/repo segment to lowercase. A successful 201 write on a mixed-case-slug repo therefore false-negatived ("did not land on a pull request") even though the comment genuinely landed — fail-closed on a real success, not a false success, but broken for legitimate mixed-case-slug repos. Lowercase both sides of the path comparison inside _belongs (path and expected_path) while leaving the origin tuple comparison, _origin_and_path's scheme+host lowercasing, and the full (non-suffix) path match untouched — the look-alike-host and decoy-prefix protections from #866 are unchanged; only the repo-slug segment's case sensitivity is relaxed, which is safe because Gitea repo slugs are case-insensitive and the remainder of the path is numeric. Adds a red-first regression case (comment-mixed-case-slug) modeling a mixed-case EXPECTED_REPO_SLUG against a Gitea-canonicalized lowercase pull_request_url, which fails against pre-fix code and passes after. Closes #875