🛡️ Sentinel: [HIGH] Fix CORS partial wildcard match#202
🛡️ Sentinel: [HIGH] Fix CORS partial wildcard match#202EffortlessSteven wants to merge 1 commit intomainfrom
Conversation
Fixes a security vulnerability where wildcard subdomains could match malicious domains sharing the same suffix. Now enforces a strict dot separator check.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. Note 🎁 Summarized by CodeRabbit FreeYour organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login. Comment |
Summary of ChangesHello @EffortlessSteven, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request implements a critical security fix for the CORS middleware, addressing a high-severity vulnerability that could lead to unauthorized access to sensitive API data. The core change involves refining the logic for wildcard subdomain matching to ensure that only legitimate subdomains are allowed, effectively closing a potential bypass vector. The update also includes new tests to validate the enhanced security measures and documentation of the vulnerability. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly addresses a high-severity CORS vulnerability where partial domain matches were possible with wildcard subdomains. The fix is logical and enforces that a wildcard match must be a proper subdomain by checking for a preceding dot. The inclusion of specific tests to verify this security fix is also a great addition.
However, the need to apply the same fix in two separate files (crates/app-http/src/middleware/cors.rs and crates/http-middleware/src/cors.rs) highlights a significant code duplication issue. This duplication of security-sensitive logic creates a maintainability risk, as future updates could easily be missed in one of the locations. I've added comments to this effect. While this PR should be merged to fix the vulnerability, I strongly recommend creating a follow-up task to refactor the CORS logic into a single, reusable component within the http-middleware crate.
| if schemes_match && origin.ends_with(wildcard_domain) { | ||
| // Security fix: Ensure the match is a proper subdomain (preceded by a dot) | ||
| // This prevents "https://evilexample.com" from matching "https://*.example.com" | ||
| let prefix_len = origin.len() - wildcard_domain.len(); | ||
| return prefix_len > 0 && origin.as_bytes()[prefix_len - 1] == b'.'; | ||
| } |
There was a problem hiding this comment.
This logic is also present in crates/http-middleware/src/cors.rs. This code duplication for security-sensitive logic is a maintainability risk. A future refactoring should aim to have a single implementation of this logic in the http-middleware crate, which app-http can then call. This will ensure that future security patches only need to be applied in one place.
| if schemes_match && origin.ends_with(wildcard_domain) { | ||
| // Security fix: Ensure the match is a proper subdomain (preceded by a dot) | ||
| // This prevents "https://evilexample.com" from matching "https://*.example.com" | ||
| let prefix_len = origin.len() - wildcard_domain.len(); | ||
| return prefix_len > 0 && origin.as_bytes()[prefix_len - 1] == b'.'; | ||
| } |
There was a problem hiding this comment.
This logic is also present in crates/app-http/src/middleware/cors.rs. This code duplication for security-sensitive logic is a maintainability risk. A future refactoring should aim to consolidate this logic into this crate (http-middleware) so that it can be reused by other crates like app-http without duplication. This will ensure that future security patches only need to be applied in one place.
There was a problem hiding this comment.
Pull request overview
This PR fixes a CORS origin validation vulnerability where wildcard subdomain rules (e.g., https://*.example.com) could be bypassed by partial suffix matches (e.g., https://evilexample.com). The change applies to both CORS implementations in the codebase (in http-middleware and app-http) and adds regression tests to prevent reintroduction.
Changes:
- Tighten wildcard subdomain origin matching by requiring the matched suffix to be preceded by
.. - Add security regression tests ensuring partial-suffix origins are rejected while valid subdomains remain allowed.
- Document the vulnerability and prevention guidance in
.jules/sentinel.md.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| crates/http-middleware/src/cors.rs | Adds dot-anchored validation for wildcard subdomain matches and a regression test. |
| crates/app-http/src/middleware/cors.rs | Mirrors the same dot-anchored wildcard subdomain fix and adds the corresponding regression test. |
| .jules/sentinel.md | Records the vulnerability, learning, and prevention guidance for future reference. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
🚨 Severity: HIGH
💡 Vulnerability: The CORS middleware allowed partial domain matches when using wildcard subdomains (e.g.,
https://*.example.commatchedhttps://evilexample.com).🎯 Impact: Attackers could bypass CORS restrictions by registering domains that suffix-match the allowed wildcard domain, potentially allowing them to access sensitive API data.
🔧 Fix: Enforced that wildcard matches must be preceded by a dot (
.), ensuring only proper subdomains are allowed.✅ Verification: Added
test_cors_config_subdomain_wildcard_securityincrates/app-httpandcrates/http-middlewareto verify that partial matches are rejected while valid subdomains are still allowed.PR created automatically by Jules for task 1160147892567240900 started by @EffortlessSteven