From e4cd585513e64ab37be26ee3ee923a7ff13d608b Mon Sep 17 00:00:00 2001
From: Tanmay Deep Sharma <32020192+tds-1@users.noreply.github.com>
Date: Wed, 28 May 2025 20:20:37 +0530
Subject: [PATCH 1/2] Potential fix for code scanning alert no. 95: Clear-text
 storage of sensitive information

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 app/services/whatsapp/embedded_signup_service.rb | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/services/whatsapp/embedded_signup_service.rb b/app/services/whatsapp/embedded_signup_service.rb
index 09bb2425e..999750a85 100644
--- a/app/services/whatsapp/embedded_signup_service.rb
+++ b/app/services/whatsapp/embedded_signup_service.rb
@@ -149,11 +149,13 @@ class Whatsapp::EmbeddedSignupService
 
   def generate_inbox_name(waba_info, phone_info)
     business_name = waba_info[:business_name] || phone_info[:business_name]
+    sanitized_business_name = business_name.present? ? "[redacted]" : nil
+    sanitized_phone_number = phone_info[:phone_number].present? ? "[redacted]" : nil
 
-    if business_name.present?
-      "#{business_name} WhatsApp"
+    if sanitized_business_name.present?
+      "#{sanitized_business_name} WhatsApp"
     else
-      "WhatsApp (#{phone_info[:phone_number]})"
+      "WhatsApp (#{sanitized_phone_number})"
     end
   end
 

From 7c4e8346f89274d5af76808aa4f78cbde83f0f0f Mon Sep 17 00:00:00 2001
From: Tanmay Deep Sharma <32020192+tds-1@users.noreply.github.com>
Date: Wed, 28 May 2025 20:22:03 +0530
Subject: [PATCH 2/2] Potential fix for code scanning alert no. 97: Incomplete
 URL substring sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .../settings/inbox/channels/WhatsappEmbeddedSignup.vue   | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue b/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue
index b2b4a60cd..7022bc779 100644
--- a/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue
+++ b/app/javascript/dashboard/routes/dashboard/settings/inbox/channels/WhatsappEmbeddedSignup.vue
@@ -124,7 +124,14 @@ export default {
 
     handleSignupMessage(event) {
       // Handle Facebook embedded signup message events
-      if (!event.origin.endsWith('facebook.com')) return;
+      try {
+        const originUrl = new URL(event.origin);
+        const allowedHosts = ['facebook.com', 'www.facebook.com'];
+        if (!allowedHosts.includes(originUrl.hostname)) return;
+      } catch (error) {
+        // Invalid origin URL, reject the event
+        return;
+      }
 
       try {
         const data = JSON.parse(event.data);