fix(security): validate MB url-rel links by scheme + host, not substring (task/harden-resolver-link-validation)

relUrls() picked MusicBrainz link relations by substring (u.includes("bandcamp.com")) with
no scheme check, so a non-http(s) resource or a look-alike host (https://evilbandcamp.com,
javascript:...bandcamp.com...) could be returned and become an injected link's href. Now:
isHttpUrl() accepts http/https only, and matching is by PARSED hostname (=== host ||
endsWith "."+host). Resolver-only; extension unaffected; pure + unit-tested (18 total green).

Source: plan/steward-linker-security SCOUT 2026-06-17.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

service/lib.js

@@ -40,12 +40,33 @@ export function spotifyResult(hit) {
   return { ...r, primary: primaryOf(r) };
 }
 
+// True for http/https URLs only — reject javascript:, ftp:, garbage. These values flow
+// into an injected link's href, so validate the third-party MB data defensively.
+export function isHttpUrl(u) {
+  try {
+    const p = new URL(u).protocol;
+    return p === "https:" || p === "http:";
+  } catch {
+    return false;
+  }
+}
+
 // Extract direct links from a MusicBrainz artist's url-relations (zero-cred: MB stores
-// official Bandcamp / streaming URLs). Either field may be null.
+// official Bandcamp / streaming URLs). Accepts only http(s) and matches by parsed hostname
+// (not substring, so "evilbandcamp.com" / "javascript:…bandcamp.com…" don't slip through).
+// Either field may be null.
 export function relUrls(relations) {
-  const urls = (relations ?? []).map((r) => r && r.url && r.url.resource).filter(Boolean);
-  const find = (host) => urls.find((u) => u.includes(host)) ?? null;
-  return { bandcamp: find("bandcamp.com"), spotify: find("open.spotify.com") };
+  const urls = (relations ?? []).map((r) => r && r.url && r.url.resource).filter(isHttpUrl);
+  const byHost = (host) =>
+    urls.find((u) => {
+      try {
+        const h = new URL(u).hostname;
+        return h === host || h.endsWith("." + host);
+      } catch {
+        return false;
+      }
+    }) ?? null;
+  return { bandcamp: byHost("bandcamp.com"), spotify: byHost("open.spotify.com") };
 }
 
 // Link object for a confirmed MusicBrainz hit: prefer the direct url-rel links, fall back