[#225] Support wildcard in allowed origins and headers #225
dkirillov
alexvanin
Labels
No labels
P0
P1
P2
P3
good first issue
Infrastructure
blocked
bug
config
discussion
documentation
duplicate
enhancement
go
help wanted
internal
invalid
kludge
observability
perfomance
question
refactoring
wontfix
No project
No assignees
4 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: TrueCloudLab/frostfs-http-gw#225
Loading…
Add table
Reference in a new issue
No description provided.
Delete branch "mbiryukova/frostfs-http-gw:feature/cors_matching"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Signed-off-by: Marina Biryukova m.biryukova@yadro.com
ec88edd137to273459e090WIP: [#xxx] Support wildcard in allowed origins and headersto [#225] Support wildcard in allowed origins and headers@ -79,3 +81,3 @@for _, rule := range corsConfig.CORSRules {for _, o := range rule.AllowedOrigins {if o == string(origin) || o == wildcard {if o == string(origin) || o == wildcard || (strings.Contains(o, "*") && match(o, string(origin))) {I think we should check the count of the wildcards in AllowedOrigins beforehand. For the cases when stored cors configuration is invalid. Then we should throw InternalError for instance. Even though we validate config during
PutCors.This seems reasonable, let's do this with low priority. Seems like the only way to create such object for now is to write to cors container directly with invalid data.
@ -343,0 +348,4 @@func match(tmpl, str string) bool {regexpStr := "^" + regexp.QuoteMeta(tmpl) + "$"regexpStr = regexpStr[:strings.Index(regexpStr, "*")-1] + "." + regexpStr[strings.Index(regexpStr, "*"):]reg := regexp.MustCompile(regexpStr)Shall we panic or return error when AllowedOrigins may be intepreted as incorrect pattern (e.g a pattern like
*example\)I suppose we must not panic. Let's fix it. Probably in s3-gw we should do the same
Why shall be a panic here with
*example\origin?trailing backslash in the end. Also it may be invalid control character (
\c, for example) or?,+at the beginningregexp.QuoteMetaescapes all characters for exact string match, except wildcard (escaping is replaced by dot in the line below)