fix(security): validate problem source hosts

[cameroncuster]

Summary

• replace Kattis hostname substring classification with the existing exact-host URL validator
• move source classification into a dependency-free helper shared by application and E2E fixture logic
• add adversarial regression cases for subdomain, path, userinfo, query, and malformed-string tricks

Security

Resolves the three CodeQL js/incomplete-url-substring-sanitization findings by using parsed, exact-match Kattis hosts rather than url.includes('kattis.com').

Verification

• Prettier passed
• ESLint passed
• Svelte check passed
• unit tests: 199/199 passed
• targeted desktop/mobile data E2E: 14/14 passed
• git diff --check passed
• independent security review blocker resolved

---

Pull Request opened by Augment Code | View session

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gitgud	Ready	Preview, Comment	Jul 23, 2026 9:32pm