SECURITY: Restrict allowed URL patterns

Restrict allowed URL patterns for oneboxes.

spec/lib/onebox/engine/audio_com_onebox_spec.rb

@@ -20,4 +20,26 @@ RSpec.describe Onebox::Engine::AudioComOnebox do
       Onebox.preview("https://audio.com/agilov/collections/discourse-test-collection").to_s,
     ).to match(%r{<iframe src="https://audio\.com/embed/collection/1773124246389900})
   end
+
+  describe ".===" do
+    it "matches valid URL" do
+      valid_url = URI("https://audio.com/path/to/resource")
+      expect(described_class === valid_url).to eq(true)
+    end
+
+    it "matches valid URL without path" do
+      valid_url = URI("https://audio.com")
+      expect(described_class === valid_url).to eq(true)
+    end
+
+    it "does not match invalid URL with subdomain" do
+      invalid_url = URI("https://sub.audio.com/path/to/resource")
+      expect(described_class === invalid_url).to eq(false)
+    end
+
+    it "does not match invalid URL with valid domain as part of another domain" do
+      malicious_url = URI("https://audio.com.malicious.com")
+      expect(described_class === malicious_url).to eq(false)
+    end
+  end
 end