added host check for binary download url

.github/workflows/Semgrep.yml

@@ -27,7 +27,8 @@ jobs:
 
     container:
       # A Docker image with Semgrep installed. Do not change this.
-      image: returntocorp/semgrep
+      # Pinned by digest (LOC-6730 / INF-002) — tag-mutation is a supply-chain vector.
+      image: returntocorp/semgrep@sha256:9349edbadf90c3f3c0c3f55867625354e89680e6fa10d9034042af52fdb0e0d0
 
     # Skip any PR created by dependabot to avoid permission issues:
     if: (github.actor != 'dependabot[bot]')

src/main/java/com/browserstack/local/LocalBinary.java

@@ -22,6 +22,9 @@
 
 class LocalBinary {
 
+    private static final String[] ALLOWED_DOWNLOAD_HOSTS = { "browserstack.com" };
+    private static final String[] ALLOWED_DOWNLOAD_HOST_SUFFIXES = { ".browserstack.com" };
+
     private String binaryFileName;
 
     private String sourceUrl;
@@ -42,6 +45,34 @@ class LocalBinary {
             System.getProperty("java.io.tmpdir")
     };
 
+    private static String validateSourceUrl(String url) throws LocalException {
+        if (url == null || url.isEmpty()) {
+            throw new LocalException("Refusing binary download: empty source URL");
+        }
+        URL parsed;
+        try {
+            parsed = new URL(url);
+        } catch (java.net.MalformedURLException e) {
+            throw new LocalException("Refusing binary download: malformed source URL");
+        }
+        if (!"https".equalsIgnoreCase(parsed.getProtocol())) {
+            throw new LocalException("Refusing binary download from non-HTTPS source URL");
+        }
+        String host = parsed.getHost();
+        if (host == null || host.isEmpty()) {
+            throw new LocalException("Refusing binary download: source URL has no host");
+        }
+        host = host.toLowerCase();
+        for (String allowed : ALLOWED_DOWNLOAD_HOSTS) {
+            if (host.equals(allowed)) return url;
+        }
+        for (String suffix : ALLOWED_DOWNLOAD_HOST_SUFFIXES) {
+            if (host.endsWith(suffix)) return url;
+        }
+        throw new LocalException(
+            "Refusing binary download: host '" + host + "' is not in the allowed host list");
+    }
+
     LocalBinary(String path, String key) throws LocalException {
         this.key = key;
         initialize();
@@ -235,7 +266,7 @@ private void fetchSourceUrl() throws LocalException {
               if (json.has("error")) {
                 throw new Exception(json.getString("error"));
               }
-              this.sourceUrl = json.getJSONObject("data").getString("endpoint");
+              this.sourceUrl = validateSourceUrl(json.getJSONObject("data").getString("endpoint"));
               if(fallbackEnabled) downloadFailureThrowable = null;
           }
         } catch (Throwable e) {