Merge pull request #977 from Cold-Coast/fix/cors_match

Fix cors match

Author: or-else

server/media/media.go

@@ -59,23 +59,68 @@ func GetIdFromUrl(url, serveUrl string) types.Uid {
 
 // matchCORSOrigin compares origin from the HTTP request to a list of allowed origins.
 func matchCORSOrigin(allowed []string, origin string) string {
-	if origin == "" {
-		// Request has no Origin header.
+	if len(allowed) == 0 {
+		// Not configured
 		return ""
 	}
 
-	if len(allowed) == 0 {
-		// Not configured
+	if origin == "" && allowed[0] != "*" {
+		// Request has no Origin header and "*" (any origin) not allowed.
 		return ""
 	}
 
 	if allowed[0] == "*" {
-		return "*"
+		if origin == "" {
+			return "*"
+		}
+		return origin
+	}
+
+	originUrl, err := url.ParseRequestURI(origin)
+	if err != nil {
+		return ""
 	}
+	originParts := strings.Split(originUrl.Hostname(), ".")
 
-	origin = strings.ToLower(origin)
 	for _, val := range allowed {
-		if strings.ToLower(val) == origin {
+		if val == origin {
+			return origin
+		}
+
+		if !strings.Contains(val, "*") {
+			continue
+		}
+
+		allowedUrl, err := url.ParseRequestURI(val)
+		if err != nil {
+			continue
+		}
+
+		if originUrl.Scheme != allowedUrl.Scheme {
+			continue
+		}
+
+		if originUrl.Port() != allowedUrl.Port() {
+			continue
+		}
+
+		allowedParts := strings.Split(allowedUrl.Hostname(), ".")
+
+		if len(originParts) != len(allowedParts) {
+			continue
+		}
+
+		matched := true
+		for i, part := range allowedParts {
+			if part == "*" {
+				continue
+			}
+			if part != originParts[i] {
+				matched = false
+				break
+			}
+		}
+		if matched {
 			return origin
 		}
 	}

server/media/media_test.go

@@ -0,0 +1,121 @@
+package media
+
+import (
+	"testing"
+)
+
+func TestMatchCORSOrigin(t *testing.T) {
+	cases := []struct {
+		allowed  []string
+		origin   string
+		expected string
+	}{
+		{
+			allowed:  []string{"https://example.com"},
+			origin:   "https://example.com",
+			expected: "https://example.com",
+		},
+		{
+			allowed:  []string{"https://example2.com", "https://example.com"},
+			origin:   "https://example.com",
+			expected: "https://example.com",
+		},
+		{
+			allowed:  []string{"*"},
+			origin:   "https://example.com",
+			expected: "https://example.com",
+		},
+		{
+			allowed:  []string{""},
+			origin:   "https://example.com",
+			expected: "",
+		},
+		{
+			allowed:  []string{},
+			origin:   "",
+			expected: "",
+		},
+		{
+			allowed:  []string{"https://example.com"},
+			origin:   "",
+			expected: "",
+		},
+		{
+			allowed:  []string{},
+			origin:   "https://example.com",
+			expected: "",
+		},
+		{
+			allowed:  []string{"http://example.com"},
+			origin:   "https://example.com",
+			expected: "",
+		},
+		{
+			allowed:  []string{"https://example.com"},
+			origin:   "http://example.com",
+			expected: "",
+		},
+		{
+			allowed:  []string{"http://example.com:8000"},
+			origin:   "http://example.com:8000",
+			expected: "http://example.com:8000",
+		},
+		{
+			allowed:  []string{"http://localhost:8090"},
+			origin:   "http://localhost:8090",
+			expected: "http://localhost:8090",
+		},
+		{
+			allowed:  []string{"http://localhost:8090"},
+			origin:   "http://localhost:8080",
+			expected: "",
+		},
+		{
+			allowed:  []string{"https://example.com"},
+			origin:   "https://sub.example.com",
+			expected: "",
+		},
+		{
+			allowed:  []string{"https://*.example.com"},
+			origin:   "https://sub.example.com",
+			expected: "https://sub.example.com",
+		},
+		{
+			allowed:  []string{"https://*.example.com"},
+			origin:   "https://pre.sub.example.com",
+			expected: "",
+		},
+		{
+			allowed:  []string{"https://*.example.com", "https://*.sub.example.com"},
+			origin:   "https://pre.sub.example.com",
+			expected: "https://pre.sub.example.com",
+		},
+		{
+			allowed:  []string{"https://*.*.example.com"},
+			origin:   "https://pre.sub.example.com",
+			expected: "https://pre.sub.example.com",
+		},
+		{
+			allowed:  []string{"https://*.sub.example.com"},
+			origin:   "https://pre.asd.example.com",
+			expected: "",
+		},
+		{
+			allowed:  []string{"https://pre.*.example.com"},
+			origin:   "https://pre.sub.example.com",
+			expected: "https://pre.sub.example.com",
+		},
+		{
+			allowed:  []string{"https://*.*.*.example.com"},
+			origin:   "https://www.pre.sub.example.com",
+			expected: "https://www.pre.sub.example.com",
+		},
+	}
+
+	for _, tc := range cases {
+		result := matchCORSOrigin(tc.allowed, tc.origin)
+		if result != tc.expected {
+			t.Errorf("Match CORS origin got wrong result. Expected %s, got %s", tc.expected, result)
+		}
+	}
+}

server/tinode.conf

@@ -110,7 +110,7 @@
 				"upload_dir": "uploads",
 				// Cache-Control header to use for uploaded files. 86400 seconds = 24 hours.
 				"cache_control": "max-age=86400",
-				// Origin URLs allowed to download/upload files, e.g. ["https://www.example.com", "http://example.com"].
+				// Origin URLs allowed to download/upload files, e.g. ["https://www.example.com", "http://example.com", "https://*.example.com", "http://*.*.example.com"].
 				// Not necessary in most cases.
 				// "cors_origins": ["*"]
 			},