You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'm not sure its worthy of a security thing, as this is just correlations and set in frontend code, but it seems like a bug that may trip someone up. Either the lists should take in a real regex or the matching logic should be tightened.
Both the include and exclude lists are "contains" (and may contain (some) regex...)
day.example.com will also match monday.example.com (and day.example.com.otherdomain.net) bar.net will also match foobar.net
the same with excludedDomains where bar.example.com will exclude foobar.example.com. (and bar.example.com.otherdomain.net)
The semi regex will work, but not if it contains a backwards slash or a ..
I would suggest making the existing ones match exact domain if there is no wildcard at start. And I would create a regex overload for both so we can use real regexes to match.
The text was updated successfully, but these errors were encountered:
The domain name in the include list is compared as a contains and not a complete match even when not including wildcards.
ApplicationInsights-JS/shared/AppInsightsCommon/src/Util.ts
Line 72 in d2c53e4
I'm not sure its worthy of a security thing, as this is just correlations and set in frontend code, but it seems like a bug that may trip someone up. Either the lists should take in a real regex or the matching logic should be tightened.
Both the include and exclude lists are "contains" (and may contain (some) regex...)
day.example.com
will also matchmonday.example.com
(andday.example.com.otherdomain.net
)bar.net
will also matchfoobar.net
the same with excludedDomains where
bar.example.com
will excludefoobar.example.com
. (andbar.example.com.otherdomain.net
)The semi regex will work, but not if it contains a backwards slash or a
.
.I would suggest making the existing ones match exact domain if there is no wildcard at start. And I would create a regex overload for both so we can use real regexes to match.
The text was updated successfully, but these errors were encountered: