Python: fix for Incomplete URL substring sanitization

[eavanvalkenburg]

Potential fix for https://github.com/microsoft/agent-framework/security/code-scanning/29

To address this issue, the safest approach is to parse any URL present in the text line and check that its host is exactly or a subdomain of azurecontainerapps.io before sending the progress message.

Specifically, edit the block spanning line 470:

• Instead of low-confidence substring matching, use a regular expression to extract URLs from the line.
• For each URL found, use urllib.parse.urlparse to parse it.
• If the parsed hostname matches azurecontainerapps.io or a subdomain (*.azurecontainerapps.io), then trigger the message.
• To do this, you will need to import urlparse from urllib.parse and likely re for regex.

No change of existing behavior except making detection robust.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[markwallace-microsoft]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	14988	2207	85%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
2039	127 💤	0 ❌	0 🔥	40.834s ⏱️

[eavanvalkenburg]

@copilot please have a look at the failures and fix them

[Copilot]

@eavanvalkenburg I've opened a new pull request, #2296, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

Pull Request Overview

This PR addresses a security code scanning alert (#29) related to incomplete URL substring sanitization in the Azure deployment module. The fix enhances security by properly parsing and validating URLs before triggering deployment notifications.

Key Changes:

• Replaced naive substring matching ("https://" in line_text and ".azurecontainerapps.io" in line_text) with robust URL parsing and hostname validation
• Uses regex to extract URLs and urlparse to validate that hostnames are exactly or subdomains of azurecontainerapps.io

Reviewed Changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
python/packages/devui/agent_framework_devui/_deployment.py	Implements secure URL validation using regex extraction, URL parsing, and hostname verification to prevent URL spoofing attacks
python/uv.lock	Version bump for agent-framework-ag-ui package from 1.0.0b251114 to 1.0.0b251117