chromium-insecure-gurl: fix gurl detection

assets/semgrep_rules/c/chromium-insecure-gurl.yaml

@@ -7,18 +7,23 @@ rules:
         thypon
         fmarier
     pattern-either:
-      - pattern: GURL $VAR = ...;
-      - pattern: KURL $VAR = ...;
-      - pattern: $VAR.DeprecatedGetOriginAsURL();
+      - patterns:
+        - pattern: $TYPE $VAR = ...;
+        - metavariable-regex:
+            metavariable: $VAR
+            regex: origin
+        - metavariable-regex:
+            metavariable: $TYPE
+            regex: ^(G|K)URL$
+      - pattern: ((GURL)$VAR).DeprecatedGetOriginAsURL();
       - pattern: SecurityOrigin::Create((KURL $VAR));
       - pattern: SecurityOrigin::Create((GURL $VAR));
-    message: >
-      Use origin (rather than URL) for security decisions.
 
+    message: |
+      Use origin (rather than URL) for security decisions.
 
       URLs are often not sufficient for security decisions, since the origin may not be present in the URL (e.g., about:blank), may be tricky to parse (e.g., blob: or filesystem: URLs), or may be opaque despite a normal-looking URL (e.g., the security context may be sandboxed). Use origins whenever possible.
 
-
       https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/security/origin-vs-url.md
     languages:
       - cpp

t3sts/semgrep_rules/insecure-gurl.cpp

@@ -1,5 +1,5 @@
 int main() {
-    // chromium-insecure-gurl
+    // ok: chromium-insecure-gurl
     GURL url = ...;
     // chromium-insecure-gurl
     GURL origin = url.DeprecatedGetOriginAsURL();
@@ -14,7 +14,7 @@ int main() {
     //       represent origins" section below.
 
     // Blink-specific example:
-    // chromium-insecure-gurl
+    // ok: chromium-insecure-gurl
     KURL url = ...;
     // chromium-insecure-gurl
     scoped_refptr<SecurityOrigin> origin = SecurityOrigin::Create(url);