fix(security): validate problem source hosts

e2e/data.spec.ts

@@ -2,6 +2,7 @@ import { test, expect, type Page } from '@playwright/test';
 import { collect, expectClean, waitForShell } from './support/harness.ts';
 import { PROBLEMS, CONTESTS, LEADERBOARD } from './support/fixtures.ts';
 import { setScenario } from './support/scenario.ts';
+import { getProblemSource } from '../src/lib/services/problemSource.ts';
 
 test.beforeEach(async () => {
   await setScenario('data');
@@ -67,15 +68,15 @@ test.describe('problems data', () => {
 
     // First click -> codeforces only.
     await sourceFilter.click();
-    const codeforces = PROBLEMS.filter((p) => !p.url.includes('kattis.com'));
+    const codeforces = PROBLEMS.filter((p) => getProblemSource(p.url) === 'codeforces');
     await expect(rows).toHaveCount(codeforces.length);
     for (const p of codeforces) {
       await expect(page.getByRole('link', { name: p.name, exact: true })).toBeVisible();
     }
 
     // Second click -> kattis only.
     await sourceFilter.click();
-    const kattis = PROBLEMS.filter((p) => p.url.includes('kattis.com'));
+    const kattis = PROBLEMS.filter((p) => getProblemSource(p.url) === 'kattis');
     await expect(rows).toHaveCount(kattis.length);
     for (const p of kattis) {
       await expect(page.getByRole('link', { name: p.name, exact: true })).toBeVisible();

src/lib/services/problem.ts

@@ -3,6 +3,7 @@
  */
 import { supabase } from './database';
 import { user } from './auth';
+import { getProblemSource } from './problemSource';
 import { get } from 'svelte/store';
 
 /**
@@ -52,13 +53,6 @@ export type UserSolvedProblem = {
   solved_at: string;
 };
 
-/**
- * Determine the problem source based on URL
- */
-export function getProblemSource(url: string): 'codeforces' | 'kattis' {
-  return url.includes('kattis.com') ? 'kattis' : 'codeforces';
-}
-
 /**
  * Columns selected when reading problems for display. Kept explicit so we only
  * fetch what the UI needs instead of every row column.

src/lib/services/problemSource.ts

@@ -0,0 +1,6 @@
+import { parseKattisProblemId } from './kattisUrl.ts';
+
+/** Determine the problem source using the exact-host Kattis URL validator. */
+export function getProblemSource(url: string): 'codeforces' | 'kattis' {
+  return parseKattisProblemId(url) ? 'kattis' : 'codeforces';
+}

tests/problem-source.test.ts

@@ -0,0 +1,24 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { getProblemSource } from '../src/lib/services/problemSource.ts';
+
+test('classifies canonical Kattis problem URLs', () => {
+  assert.equal(getProblemSource('https://open.kattis.com/problems/hello'), 'kattis');
+  assert.equal(getProblemSource('https://kattis.com/problems/hello'), 'kattis');
+});
+
+test('classifies ordinary Codeforces problem URLs', () => {
+  assert.equal(getProblemSource('https://codeforces.com/problemset/problem/1/A'), 'codeforces');
+});
+
+test('does not classify URLs by an untrusted hostname substring', () => {
+  for (const url of [
+    'https://open.kattis.com.evil.example/problems/hello',
+    'https://evil.example/open.kattis.com/problems/hello',
+    'https://open.kattis.com@evil.example/problems/hello',
+    'https://evil.example/?next=https://open.kattis.com/problems/hello',
+    'not-a-url-containing-kattis.com'
+  ]) {
+    assert.equal(getProblemSource(url), 'codeforces');
+  }
+});