From 43a5ff532c6ed43257b05ad6ac431a23cb8a9562 Mon Sep 17 00:00:00 2001
From: Charles de Dreuille <charles.dedreuille@gmail.com>
Date: Mon, 24 Mar 2025 17:53:57 +0000
Subject: [PATCH] Potential fix for code scanning alert no. 1043: Incomplete
 URL substring sanitization

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: Charles de Dreuille <charles.dedreuille@gmail.com>
---
 packages/canon/src/components/TextField/TextField.stories.tsx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/packages/canon/src/components/TextField/TextField.stories.tsx b/packages/canon/src/components/TextField/TextField.stories.tsx
index a9af58dcf9..e378fc1c58 100644
--- a/packages/canon/src/components/TextField/TextField.stories.tsx
+++ b/packages/canon/src/components/TextField/TextField.stories.tsx
@@ -98,7 +98,8 @@ async function submitForm(value: string) {
   try {
     const url = new URL(value);
 
-    if (url.hostname.endsWith('example.com')) {
+    const allowedHosts = ['example.com', 'beta.example.com', 'www.example.com'];
+    if (!allowedHosts.includes(url.hostname)) {
       return { error: 'The example domain is not allowed' };
     }
   } catch {