Validate HuggingFace URL prefix correctly in HuggingFaceUrl constructor

[Osamaali313]

Problem

HuggingFaceUrl's constructor checks the base-URL prefix without the trailing slash, then strips a hardcoded 23 characters:

if (!modelNameOrUrl.StartsWith(BaseUrl, StringComparison.OrdinalIgnoreCase))   // BaseUrl = "https://huggingface.co" (22 chars)
{
    throw new ArgumentException("Invalid URL", nameof(modelNameOrUrl));
}
modelNameOrUrl = modelNameOrUrl[23..];

Two concrete, deterministic failures result:

1. The exact base URL "https://huggingface.co" (22 chars) passes the loose check, then [23..] indexes past the end → ArgumentOutOfRangeException instead of the ArgumentException("Invalid URL") thrown by every other invalid-input path.
2. A lookalike host "https://huggingface.competitor.com/evil/repo" passes the loose StartsWith check, then [23..] slices mid-domain → silently mis-parses to Organization = "petitor.com" instead of being rejected.

The sibling GitHubUrl constructor already does this correctly (StartsWith($"{BaseUrl}/") and url[(BaseUrl.Length + 1)..]).

Reproduction (real ModelUrl.cs in a console harness)

before:  new HuggingFaceUrl("https://huggingface.co")                              => THROW ArgumentOutOfRangeException
before:  new HuggingFaceUrl("https://huggingface.competitor.com/evil/repo")        => Org=petitor.com Repo=evil
after:   new HuggingFaceUrl("https://huggingface.co")                              => THROW ArgumentException
after:   new HuggingFaceUrl("https://huggingface.competitor.com/evil/repo")        => THROW ArgumentException

Valid inputs (https://huggingface.co/org/repo, org/repo) are unchanged.

Fix

Require the trailing slash and strip BaseUrl.Length + 1, mirroring GitHubUrl:

if (!modelNameOrUrl.StartsWith($"{BaseUrl}/", StringComparison.OrdinalIgnoreCase)) { ... }
modelNameOrUrl = modelNameOrUrl[(BaseUrl.Length + 1)..];

Test

Adds ConstructorWithBaseUrlOnlyShouldThrowArgumentException and ConstructorWithLookalikeDomainShouldThrowException to ModelUrlTests.cs (both Assert.ThrowsExactly<ArgumentException>).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[haoliuu]

LGTM. Thanks for making the change.