fix(OSQUERY-010): 2 review findings in apt_sources.cpp

[flamingo]

Closes 2 review findings in osquery/tables/system/linux/apt_sources.cpp.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 95 high	apt_sources.cpp back()-on-empty-string risk when parsing base_uri trailing slashes	osquery/tables/system/linux/apt_sources.cpp:89
2	🟢 95 high	Same unchecked .back() pattern repeated in parseDeb822Block URI trimming	osquery/tables/system/linux/apt_sources.cpp:253

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 01e7aadc-0204-47ef-b373-fc5dbadf3ab5

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

[flamingo]

🦩 What this fix changed, finding by finding

2 finding(s) fixed in this draft — 2 explained inline on the diff.

[flamingo]

🦩 🟠 apt_sources.cpp back()-on-empty-string risk when parsing base_uri trailing slashes

In parseAptSourceLine, the trailing-slash trimming loop on apt_source.base_uri now checks !apt_source.base_uri.empty() before calling .back(), preventing undefined behavior when the URI is all slashes.

🤖 Prompt for AI agents

In osquery/tables/system/linux/apt_sources.cpp around line 89, review and complete this code-review fix: apt_sources.cpp back()-on-empty-string risk when parsing base_uri trailing slashes.
What the draft fix changed: In `parseAptSourceLine`, the trailing-slash trimming loop on `apt_source.base_uri` now checks `!apt_source.base_uri.empty()` before calling `.back()`, preventing undefined behavior when the URI is all slashes.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 Same unchecked .back() pattern repeated in parseDeb822Block URI trimming

In parseDeb822Block, the trailing-slash trimming loop on uri (inside the key == "uris" branch) now checks !uri.empty() before calling .back(), preventing undefined behavior for malformed all-slash URIs from DEB822 sources.

🤖 Prompt for AI agents

In osquery/tables/system/linux/apt_sources.cpp around line 253, review and complete this code-review fix: Same unchecked .back() pattern repeated in parseDeb822Block URI trimming.
What the draft fix changed: In `parseDeb822Block`, the trailing-slash trimming loop on `uri` (inside the `key == "uris"` branch) now checks `!uri.empty()` before calling `.back()`, preventing undefined behavior for malformed all-slash URIs from DEB822 sources.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer