From ac9ca034b42fc891df3006a51ff659f788a85049 Mon Sep 17 00:00:00 2001
From: Pierre Wizla <4233866+pwizla@users.noreply.github.com>
Date: Wed, 26 Aug 2026 16:32:49 +0200
Subject: [PATCH] Match allowed link hosts on a literal dot

The host list was written with backslash-escaped dots and passed to awk through
-v, where a backslash is a string escape rather than a regex one. awk consumed
it, gawk warned "escape sequence \. treated as plain .", and the dot became a
wildcard: https://strapiXio.evil.com was accepted as an allowed host. Writing
the dots as [.] survives -v untouched.

Verified: the four legitimate hosts still pass, strapiXio.evil.com and
notstrapi.io are now blocked, and the warning that appeared in the #3366 run
summary is gone.
---
 .github/scripts/automerge/check-no-external-links.sh | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.github/scripts/automerge/check-no-external-links.sh b/.github/scripts/automerge/check-no-external-links.sh
index 427d4bf364..30058d8195 100755
--- a/.github/scripts/automerge/check-no-external-links.sh
+++ b/.github/scripts/automerge/check-no-external-links.sh
@@ -14,7 +14,13 @@ set -euo pipefail
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
 
 # Extended regex of hosts that do not count as external.
-ALLOWED_HOSTS="${AUTOMERGE_ALLOWED_LINK_HOSTS:-strapi\.io|docs\.strapi\.io|github\.com/strapi|market\.strapi\.io|cloud\.strapi\.io}"
+#
+# Dots are written [.] rather than \. on purpose. This string reaches awk through
+# -v, where a backslash is a STRING escape, not a regex one: awk consumes it and
+# gawk warns "escape sequence \. treated as plain .". The dot then matches any
+# character, so `strapiXio.evil.com` would have been accepted as an allowed host.
+# [.] survives -v untouched and means exactly one literal dot.
+ALLOWED_HOSTS="${AUTOMERGE_ALLOWED_LINK_HOSTS:-strapi[.]io|docs[.]strapi[.]io|github[.]com/strapi|market[.]strapi[.]io|cloud[.]strapi[.]io}"
 
 PR="${1:-}"
 require_pr_number "$PR"