[nmnishant-browserstack]

Why

The Security retest of DEVA11Y-479 and DEVA11Y-488 at 806f98cb found that the --download-url / BROWSERSTACK_A11Y_CLI_DOWNLOAD_URL override still accepted any HTTPS host. Anyone who can set that env var (CI env injection, a malicious PR workflow, a poisoned .env) could point the plugin at their own server. #46 closed the redirect and integrity gaps; this closes the remaining ones:

1. Restrict the override to an allowlisted host.
2. Remove the file:// copy branch in download().

What

54eba31 – override host allowlist

• parseOverride() now requires https and a host of browserstack.com or a subdomain. It reuses isAllowedRedirectTarget() from fix(security): fail-closed CLI signature verification + https/browserstack.com redirect allowlist [DEVA11Y-473] #46, so the override and every redirect hop follow one policy.
• Removed the url.isFileURL branches in resolveOverrideArtifact() and download(). download() now refuses any URL outside the policy before fetching, so a file URL can never be copied, however it was produced.
• github.com is not allowlisted, departing from the ticket's suggestion: GitHub release downloads redirect to codeload.github.com / objects.githubusercontent.com, which the fix(security): fail-closed CLI signature verification + https/browserstack.com redirect allowlist [DEVA11Y-473] #46 redirect policy rejects, so allowing it here would only produce a confusing failure later. Rationale in this comment on 479.

0126efa – reject . as a cache version

• extractVersion() accepted a filename ending in -..zip as version ., which resolves to the cache root itself. Found while replaying the C-002 chain for DEVA11Y-486; it doesn't reopen that chain.

Tests

• New tests/download-url-policy/run_tests.sh lifts parseOverride, isAllowedRedirectTarget and extractVersion verbatim from the plugin source and checks them against a case table. It needs no network and no credentials, and runs as a new download-url-policy job in spm-smoke-test.yml.

Testing

Policy suite: 30/30 pass. Against main before this change, 11 of the 23 URL cases fail, so the suite detects the gap.

Accepted	Rejected
https://api.browserstack.com/sdk/v1/download_cli?…	https://evil.example/cli.zip
https://sdk-assets.browserstack.com/…	https://api.browserstack.com@evil.example/… (userinfo trick)
https://browserstack.com/…	https://evilbrowserstack.com/…, https://browserstack.com.evil.example/…
HTTPS://API.BROWSERSTACK.COM/… (case)	https://127.0.0.1/…, https://169.254.169.254/…
https://api.browserstack.com:443/…	https://github.com/…, http://…, ftp://…, file://…, /tmp/cli.zip, https:///cli.zip

End to end: the plugin was built and run via tests/spm on macOS:

$ swift package … scan --download-url 'https://evil.example/cli.zip'
error: Unsupported host 'evil.example' in download URL. Only browserstack.com hosts are allowed.
$ swift package … scan --download-url 'https://api.browserstack.com@evil.example/cli.zip'
error: Unsupported host 'evil.example' in download URL. Only browserstack.com hosts are allowed.
$ swift package … scan --download-url 'file:///tmp/cli.zip'
error: Unsupported URL scheme 'file' in download URL. Only HTTPS is allowed.

The default download (no override) is unchanged: it downloads CLI 1.63.0 and passes the signature check.

Authenticated sanity scan (macOS, Xcode 26.3 / Swift 6.2.4, production BrowserStack account). The plugin was rebuilt from this branch with a clean tests/spm/.build, then tests/spm/scripts/run-a11y-scan.sh ran against the harness:

Check	Result
Fresh CLI download (BROWSERSTACK_A11Y_CLI_FORCE_DOWNLOAD=1) through the changed path	✅ CLI 1.63.0, TeamIdentifier=YQ5FZQ855D
--non-strict scan	✅ exit 0 in 13s; authenticated and reported the 3 intentional issues in SampleViews.swift (imageview-element-content-label, interactable-element-content-label, switch-element-content-label)
Strict scan	✅ exit 1, so the issues fail the run as expected

Note for local runs: RUN_A11Y_SCAN=1 swift test hung here (~10 min, no scan process started), most likely because the test's inner swift package plugin waits on the .build lock held by the outer swift test under SwiftPM 6.2. The two scans above are the same assertions testA11yScanPluginRuns makes, run directly. CI (macos-14) is unaffected, and this PR doesn't touch that test.

After merge

Request a Security retest of DEVA11Y-479. DEVA11Y-488 closes on that result.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML (base), Organization UI (inherited), Workspace UI (inherited); Enforced overrides: Organization
• Review profile: ASSERTIVE
• Plan: Enterprise
• Run ID: 62ba9462-887d-43f3-908b-28f6526f6a3b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}