Replace permissive URL regex with secure validation in apply form

[Copilot]

The prework link validation used a permissive regex /^https?:\/\/.+/ that accepts malformed URLs like https:// or http://malformed..url, creating a security vulnerability.

Changes

• Security: Replace regex pattern with isValidUrl() function using URL constructor
• Validation: Convert from pattern to validate for better error handling
• Types: Fix readonly array type issue in form field validation

Implementation

// Before: Permissive regex accepts malformed URLs
pattern: {
    value: /^https?:\/\/.+/,
    message: "Please enter a valid URL (starting with http:// or https://)",
}

// After: Proper URL validation rejects malformed URLs
validate: (value) => 
    isValidUrl(value) || "Please enter a valid URL (starting with http:// or https://)",

The isValidUrl() function leverages the browser's URL constructor to properly validate URLs while maintaining compatibility with legitimate prework hosting platforms.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
vets-who-code-app	Ready	Preview	Comment	Oct 29, 2025 3:49am

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• checkpoint.prisma.io
  • Triggering command: /usr/local/bin/node /home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/prisma/build/child {"product":"prisma","version":"6.10.1","cli_install_type":"local","information":"","local_timestamp":"2025-10-29T03:34:10Z","project_hash":"4713398e","cli_path":"/home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/.bin/prisma","cli_path_hash":"a42231ea","endpoint":"REDACTED","disable":false,"arch":"x64","os":"linux","node_version":"v20.19.5","ci":true,"ci_name":"GitHub Actions","command":"-v","schema_providers":["sqlite"],"schema_preview_features":["driverAdapters"],"schema_generators_providers":["prisma-client-js"],"cache_file":"/home/REDACTED/.cache/checkpoint-nodejs/prisma-a42231ea","cache_duration":43200000,"remind_duration":172800000,"force":false,"timeout":5000,"unref":true,"child_path":"/home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/prisma/build/child","client_event_id":"","previous_client_event_id":"","check_if_update_available":true} (dns block)
  • Triggering command: /usr/local/bin/node /home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/prisma/build/child {"product":"prisma","version":"6.10.1","cli_install_type":"local","information":"","local_timestamp":"2025-10-29T03:34:12Z","project_hash":"4713398e","cli_path":"/home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/.bin/prisma","cli_path_hash":"a42231ea","endpoint":"REDACTED","disable":false,"arch":"x64","os":"linux","node_version":"v20.19.5","ci":true,"ci_name":"GitHub Actions","command":"generate --postinstall \"UNABLE_TO_FIND_POSTINSTALL_TRIGGER__ENVAR_MISSING\"","schema_providers":["sqlite"],"schema_preview_features":["driverAdapters"],"schema_generators_providers":["prisma-client-js"],"cache_file":"/home/REDACTED/.cache/checkpoint-nodejs/prisma-a42231ea","cache_duration":43200000,"remind_duration":172800000,"force":false,"timeout":5000,"unref":true,"child_path":"/home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/prisma/build/child","client_event_id":"","previous_client_event_id":"","check_if_update_available":true} (dns block)
• https://api.github.com/repos/Vets-Who-Code/Prework
• https://api.github.com/repos/Vets-Who-Code/vets-who-code-app
• https://api.github.com/repos/Vets-Who-Code/web-curriculum
• https://api.github.com/repos/Vets-Who-Code/windows-dev-guide
  • Triggering command: /usr/local/bin/node /home/REDACTED/work/vets-who-code-app/vets-who-code-app/node_modules/next/dist/compiled/jest-worker/processChild.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)