Review: URL leak realism (issue #13, takeover of #7)

[Lxr-max]

Reviewer takeover of stale author PR #7 for issue #13 (user-visible mirror URL leaks). Reimplemented against current aiming-lab/WebHarbor main. Does not touch Best Buy (#135/#48), Google Flights (#136), the site registry, or .assets-revision.

Original PR: #7 (hqhq1025, May 2026, 0 comments, base far behind main)
Fork branch: https://github.com/Lxr-max/WebHarbor/tree/cursor/fix-url-leak-realism-7f54

Problem

Share/copy/next/localhost surfaces leaked local mirror hosts or example.com placeholders:

• Google Map place-detail share box used http://localhost:40008/place/<slug>
• Google Map seed websites used https://example.com/<slug>
• Booking and Allrecipes save/return forms serialized absolute request.url into hidden next inputs
• BBC News article share copied window.location.href
• GitHub external-host recovery redirected to hardcoded http://localhost:40006

Benchmark/runtime localhost URLs in tasks.jsonl and Docker docs are left intact.

What changed

Salvaged #7’s approach and corrected GitHub host-header recovery:

• Google Map share/website rendering uses a real Maps place URL, with runtime fallback for packaged example.com seed rows (no HF rewrite)
• Future Google Map seed_data.py writes Maps URLs instead of placeholders
• Booking/Allrecipes next fields are root-relative; redirects accept only /... paths
• BBC share copies source_url (BBC fallback if missing); main.js no longer copies the mirror location
• GitHub Host: github.com serves the local route in place instead of bouncing to :40006 (avoids Fix user-visible mirror URL leaks #7’s relative-redirect loop when the Host header is sticky)
• Added docs/url-realism-audit.md, scripts/check_url_realism.py, and scripts/tests/test_url_realism.py

Berkeley still has a request.url next input; left out of scope because #13 did not list it.

Verification

python3 -m py_compile sites/allrecipes/app.py sites/booking/app.py \
  sites/bbc_news/app.py sites/github/app.py sites/google_map/app.py \
  sites/google_map/seed_data.py scripts/check_url_realism.py \
  scripts/tests/test_url_realism.py
python3 scripts/check_url_realism.py
python3 -m unittest scripts.tests.test_url_realism

Results on this branch:

• py_compile OK
• scripts/check_url_realism.py → URL realism checks passed
• python3 -m unittest scripts.tests.test_url_realism → 7/7 OK

Flask test_client (isolated Google Map SQLite):

• /place/galleria-vittorio-emanuele returns 200
• share box emits https://www.google.com/maps/place/Galleria+Vittorio+Emanuele+II+Milan/
• page does not contain localhost:40008 or example.com/galleria-vittorio-emanuele

Helper contract tests (AST-loaded from the live site files, no full-app seed):

• Allrecipes/Booking current_relative_url() keeps path+query
• safe_redirect_target() rejects http://localhost:..., https://evil..., and //evil...
• BBC bbc_article_share_url() prefers source_url, else https://www.bbc.com/news/articles/<slug>
• GitHub is_external_github_host() is true for github.com and false for localhost/127.0.0.1

Docker image rebuild / /reset byte-identity was not re-run here (no Docker daemon; seed DBs untouched; Google Map uses a runtime fallback for existing example.com rows).

Fixes #13.