Replace insecure URL validation regex with proper URL constructor validation

[Copilot]

The prework link validation used a permissive regex /^https?:\/\/.+/ that could allow malicious URLs to pass validation.

Changes Made

• Security: Replace regex pattern with isValidUrl() function that uses JavaScript URL constructor
• Import: Add isValidUrl import from existing @utils/formValidations
• Validation: Update prework link field to use validate property instead of pattern

Code Changes

// Before - insecure regex validation
pattern: {
    value: /^https?:\/\/.+/,
    message: "Please enter a valid URL (starting with http:// or https://)",
}

// After - secure URL constructor validation
validate: (value) => {
    if (!isValidUrl(value)) {
        return "Please enter a valid URL (starting with http:// or https://)";
    }
    return true;
}

The isValidUrl() function leverages the browser's native URL constructor for robust validation that prevents malformed and potentially malicious URLs while maintaining the same user experience.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
vets-who-code-app	Ready	Preview	Comment	Oct 29, 2025 3:44am

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• checkpoint.prisma.io
  • Triggering command: /usr/local/bin/node /home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/prisma/build/child {"product":"prisma","version":"6.10.1","cli_install_type":"local","information":"","local_timestamp":"2025-10-29T03:33:24Z","project_hash":"4713398e","cli_path":"/home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/.bin/prisma","cli_path_hash":"a42231ea","endpoint":"REDACTED","disable":false,"arch":"x64","os":"linux","node_version":"v20.19.5","ci":true,"ci_name":"GitHub Actions","command":"-v","schema_providers":["sqlite"],"schema_preview_features":["driverAdapters"],"schema_generators_providers":["prisma-client-js"],"cache_file":"/home/REDACTED/.cache/checkpoint-nodejs/prisma-a42231ea","cache_duration":43200000,"remind_duration":172800000,"force":false,"timeout":5000,"unref":true,"child_path":"/home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/prisma/build/child","client_event_id":"","previous_client_event_id":"","check_if_update_available":true} (dns block)
  • Triggering command: /usr/local/bin/node /home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/prisma/build/child {"product":"prisma","version":"6.10.1","cli_install_type":"local","information":"","local_timestamp":"2025-10-29T03:33:27Z","project_hash":"4713398e","cli_path":"/home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/.bin/prisma","cli_path_hash":"a42231ea","endpoint":"REDACTED","disable":false,"arch":"x64","os":"linux","node_version":"v20.19.5","ci":true,"ci_name":"GitHub Actions","command":"generate --postinstall \"UNABLE_TO_FIND_POSTINSTALL_TRIGGER__ENVAR_MISSING\"","schema_providers":["sqlite"],"schema_preview_features":["driverAdapters"],"schema_generators_providers":["prisma-client-js"],"cache_file":"/home/REDACTED/.cache/checkpoint-nodejs/prisma-a42231ea","cache_duration":43200000,"remind_duration":172800000,"force":false,"timeout":5000,"unref":true,"child_path":"/home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/prisma/build/child","client_event_id":"","previous_client_event_id":"","check_if_update_available":true} (dns block)
• https://api.github.com/repos/Vets-Who-Code/Prework
  • Triggering command: /usr/local/bin/node /home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/next/dist/compiled/jest-worker/processChild.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)