From 4afdfac0aa7e0d13aba7933ef649471909ae191a Mon Sep 17 00:00:00 2001
From: CD Cabrera <cabrera.code@gmail.com>
Date: Thu, 16 Jul 2026 16:17:34 -0400
Subject: [PATCH 1/2] fix(assertions): pf-4387 block non-urls

---
 .../tool.patternFlyDocs.test.ts.snap          |  2 --
 src/__tests__/server.assertions.test.ts       | 27 ++++++++++++++++++-
 src/__tests__/tool.patternFlyDocs.test.ts     | 16 +++++------
 src/server.assertions.ts                      |  8 +++++-
 4 files changed, 39 insertions(+), 14 deletions(-)

diff --git a/src/__tests__/__snapshots__/tool.patternFlyDocs.test.ts.snap b/src/__tests__/__snapshots__/tool.patternFlyDocs.test.ts.snap
index ba2d0534..a2138d78 100644
--- a/src/__tests__/__snapshots__/tool.patternFlyDocs.test.ts.snap
+++ b/src/__tests__/__snapshots__/tool.patternFlyDocs.test.ts.snap
@@ -12,8 +12,6 @@ exports[`usePatternFlyDocsTool, callback should attempt to parse parameters, mul
 
 exports[`usePatternFlyDocsTool, callback should attempt to parse parameters, single file, mock path 1`] = `"# Content for components/button.md"`;
 
-exports[`usePatternFlyDocsTool, callback should attempt to parse parameters, with invalid urlList 1`] = `"# Content for invalid-path"`;
-
 exports[`usePatternFlyDocsTool, callback should attempt to parse parameters, with name and actual path 1`] = `"# Content for documentation:chatbot/README.md"`;
 
 exports[`usePatternFlyDocsTool, callback should have a specific markdown format: Button 1`] = `
diff --git a/src/__tests__/server.assertions.test.ts b/src/__tests__/server.assertions.test.ts
index 7bf4979f..c89bdb77 100644
--- a/src/__tests__/server.assertions.test.ts
+++ b/src/__tests__/server.assertions.test.ts
@@ -292,6 +292,31 @@ describe('assertInputStringNumberEnumLike', () => {
 
 describe('assertInputUrlWhiteListed', () => {
   it.each([
+    {
+      description: 'empty string',
+      input: '',
+      compare: ['https://patternfly.org']
+    },
+    {
+      description: 'undefined',
+      input: undefined,
+      compare: ['https://patternfly.org']
+    },
+    {
+      description: 'null',
+      input: null,
+      compare: ['https://patternfly.org']
+    },
+    {
+      description: 'number',
+      input: 1,
+      compare: ['https://patternfly.org']
+    },
+    {
+      description: 'string',
+      input: 'lorem ipsum',
+      compare: ['https://patternfly.org']
+    },
     {
       description: 'URL and display name',
       input: 'https://github.com/patternfly',
@@ -322,7 +347,7 @@ describe('assertInputUrlWhiteListed', () => {
     const errorMessage = 'Lorem ipsum error message for validation.';
 
     expect(() => assertInputUrlWhiteListed(
-      'https://github.com/patternfly',
+      false,
       ['http://patternfly.org'],
       { message: errorMessage, codeOrError: (message, cause) => new Error(`Custom: ${message}`, { cause }) }
     )).toThrow(`Custom: ${errorMessage}`);
diff --git a/src/__tests__/tool.patternFlyDocs.test.ts b/src/__tests__/tool.patternFlyDocs.test.ts
index 800f9202..36cc374c 100644
--- a/src/__tests__/tool.patternFlyDocs.test.ts
+++ b/src/__tests__/tool.patternFlyDocs.test.ts
@@ -64,7 +64,7 @@ describe('usePatternFlyDocsTool, callback', () => {
         path: 'components/button.md',
         content: 'single documentation content'
       },
-      urlList: ['components/button.md']
+      urlList: ['https://www.patternfly.org/components/button.md']
     },
     {
       description: 'multiple files, mock paths',
@@ -72,15 +72,11 @@ describe('usePatternFlyDocsTool, callback', () => {
         path: 'components/button.md',
         content: 'combined documentation content'
       },
-      urlList: ['components/button.md', 'components/card.md', 'components/table.md']
-    },
-    {
-      description: 'with invalid urlList',
-      processedValue: {
-        path: 'invalid-path',
-        content: 'Failed to load'
-      },
-      urlList: ['invalid-url']
+      urlList: [
+        'https://www.patternfly.org/components/button.md',
+        'https://www.patternfly.org/components/card.md',
+        'https://www.patternfly.org/components/table.md'
+      ]
     },
     {
       description: 'with name and actual path',
diff --git a/src/server.assertions.ts b/src/server.assertions.ts
index 7f579074..35c1382e 100644
--- a/src/server.assertions.ts
+++ b/src/server.assertions.ts
@@ -233,10 +233,16 @@ function assertInputUrlWhiteListed(
     const isPfUri = isPatternFlyUri(url);
 
     if (isRemote) {
+      // Dive into condition to avoid flipping else
       if (!isWhitelistedUrl(url, whitelist, { allowedProtocols })) {
         invalidUrls.push(url);
       }
-    } else if (isUrl(url, { isStrict: false }) && !isPfUri) {
+    } else if (isUrl(url, { isStrict: false })) {
+      // Dive into condition to avoid flipping else
+      if (!isPfUri) {
+        invalidUrls.push(url);
+      }
+    } else {
       invalidUrls.push(url);
     }
   });

From d8734fde2b36df2cf1987a3304361c6ebf344990 Mon Sep 17 00:00:00 2001
From: CD Cabrera <cabrera.code@gmail.com>
Date: Thu, 16 Jul 2026 23:08:44 -0400
Subject: [PATCH 2/2] fix: review update

---
 src/server.assertions.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/server.assertions.ts b/src/server.assertions.ts
index 35c1382e..f34cc733 100644
--- a/src/server.assertions.ts
+++ b/src/server.assertions.ts
@@ -230,7 +230,6 @@ function assertInputUrlWhiteListed(
 
   updatedInput.forEach(url => {
     const isRemote = typeof url === 'string' && allowedProtocols.some(protocol => url.startsWith(protocol));
-    const isPfUri = isPatternFlyUri(url);
 
     if (isRemote) {
       // Dive into condition to avoid flipping else
@@ -239,7 +238,7 @@ function assertInputUrlWhiteListed(
       }
     } else if (isUrl(url, { isStrict: false })) {
       // Dive into condition to avoid flipping else
-      if (!isPfUri) {
+      if (!isPatternFlyUri(url)) {
         invalidUrls.push(url);
       }
     } else {