fix(settings): harden persisted settings and update checks

src/utils/releaseUrls.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'vitest';
+import { isTrustedFirelinkReleaseUrl } from './releaseUrls';
+
+describe('Firelink release URLs', () => {
+  it('accepts the repository release page and exact release tags', () => {
+    expect(isTrustedFirelinkReleaseUrl('https://github.com/nimbold/Firelink/releases')).toBe(true);
+    expect(isTrustedFirelinkReleaseUrl('https://github.com/nimbold/Firelink/releases/tag/v1.0.5')).toBe(true);
+  });
+
+  it('rejects lookalike paths and URLs with authority or path tricks', () => {
+    expect(isTrustedFirelinkReleaseUrl('https://github.com/nimbold/Firelink/releases-evil')).toBe(false);
+    expect(isTrustedFirelinkReleaseUrl('https://github.com/nimbold/Firelink/releases%2F..%2Fother')).toBe(false);
+    expect(isTrustedFirelinkReleaseUrl('https://github.com/nimbold/Firelink/releases/tag/v1.0.5%5C..%5Cuser%5Crepo')).toBe(false);
+    expect(isTrustedFirelinkReleaseUrl('https://github.com.evil.example/nimbold/Firelink/releases')).toBe(false);
+    expect(isTrustedFirelinkReleaseUrl('https://github.com/nimbold/Firelink/releases/tag/v1.0.5?redirect=evil')).toBe(false);
+  });
+});

src/utils/releaseUrls.ts

@@ -0,0 +1,27 @@
+const FIRELINK_RELEASES_PATH = '/nimbold/Firelink/releases';
+const FIRELINK_RELEASE_TAG_PATTERN = new RegExp(
+  `^${FIRELINK_RELEASES_PATH}/tag/[A-Za-z0-9._-]+$`
+);
+
+export const isTrustedFirelinkReleaseUrl = (value: string) => {
+  try {
+    const parsed = new URL(value);
+    if (
+      parsed.protocol !== 'https:'
+      || parsed.hostname !== 'github.com'
+      || parsed.port
+      || parsed.username
+      || parsed.password
+      || parsed.search
+      || parsed.hash
+    ) {
+      return false;
+    }
+
+    const pathname = decodeURIComponent(parsed.pathname);
+    return pathname === FIRELINK_RELEASES_PATH
+      || FIRELINK_RELEASE_TAG_PATTERN.test(pathname);
+  } catch {
+    return false;
+  }
+};