Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CorrelationHeaderDomains and CorrelationHeaderExcludedDomains has bad matchers #2456

Open
Strepto opened this issue Dec 10, 2024 · 0 comments

Comments

@Strepto
Copy link

Strepto commented Dec 10, 2024

The domain name in the include list is compared as a contains and not a complete match even when not including wildcards.

const regex = new RegExp(domain.toLowerCase().replace(/\\/g, "\\\\").replace(/\./g, "\\.").replace(/\*/g, ".*"));

I'm not sure its worthy of a security thing, as this is just correlations and set in frontend code, but it seems like a bug that may trip someone up. Either the lists should take in a real regex or the matching logic should be tightened.

Both the include and exclude lists are "contains" (and may contain (some) regex...)

{
    correlationHeaderDomains: ['day.example.com', 'bar.net'],
    correlationHeaderExcludedDomains: ['bar.example.com', '[a-z0-9]+.example.net'],
}

day.example.com will also match monday.example.com (and day.example.com.otherdomain.net)
bar.net will also match foobar.net

the same with excludedDomains where bar.example.com will exclude foobar.example.com. (and bar.example.com.otherdomain.net)

The semi regex will work, but not if it contains a backwards slash or a ..

I would suggest making the existing ones match exact domain if there is no wildcard at start. And I would create a regex overload for both so we can use real regexes to match.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant