Skip to content

fix: match allowed regex fully - #1054

Open
jmattheis wants to merge 1 commit into
masterfrom
match-fully-allowed-regex
Open

jmattheis wants to merge 1 commit into
masterfrom
match-fully-allowed-regex

Conversation

@jmattheis

Copy link
Copy Markdown
Member

Fixes #1052

@jmattheis
jmattheis requested a review from a team as a code owner September 20, 2026 17:54

@eternal-flame-AD eternal-flame-AD left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lgtm.

Also, I think a simpler solution is simply prepend/append a ^ and $ to the regex if it's not already there.

Ad a side note, I honestly didn't understand why this is strictly needed. I agree with the original issue that it seems like WebSocket won't be a viable cross origin attack vector (does not eliminate the need to exfiltrate token).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

CORS and websocket origin allowlists match unanchored, so 'https://example.com' also allows 'https://example.com.evil.net'

2 participants