huahaofeng
/
aspnetcore
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Handle malformed origin Uri (#139) 

Addresses aspnet/Home#2318
This commit is contained in:
Jass Bagga 2018-01-08 11:04:57 -08:00 committed by GitHub
parent 177f528b93
commit 95c663a289
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 30 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/Microsoft.AspNetCore.Cors/Infrastructure/CorsPolicyExtensions.cs
View File

@ -16,11 +16,16 @@ namespace Microsoft.AspNetCore.Cors.Infrastructure
{
return true;
}
var originUri = new Uri(origin, UriKind.Absolute);
return policy.Origins
.Where(o => o.Contains($"://{_WildcardSubdomain}"))
.Select(CreateDomainUri)
.Any(domain => UriHelpers.IsSubdomainOf(originUri, domain));
if (Uri.TryCreate(origin, UriKind.Absolute, out var originUri))
{
return policy.Origins
.Where(o => o.Contains($"://{_WildcardSubdomain}"))
.Select(CreateDomainUri)
.Any(domain => UriHelpers.IsSubdomainOf(originUri, domain));
}
return false;
}
private static Uri CreateDomainUri(string origin)

20
test/Microsoft.AspNetCore.Cors.Test/CorsPolicyExtensionsTests.cs
View File

@ -23,6 +23,26 @@ namespace Microsoft.AspNetCore.Cors.Infrastructure
Assert.True(actual);
}
[Theory]
[InlineData(null)]
[InlineData("null")]
[InlineData("http://")]
[InlineData("http://*")]
[InlineData("http://.domain")]
[InlineData("http://.domain/hello")]
public void IsOriginAnAllowedSubdomain_ReturnsFalseIfOriginIsMalformedUri(string malformedOrigin)
{
// Arrange
var policy = new CorsPolicy();
policy.Origins.Add("http://*.domain");
// Act
var actual = policy.IsOriginAnAllowedSubdomain(malformedOrigin);
// Assert
Assert.False(actual);
}
[Theory]
[InlineData("http://sub.domain", "http://*.domain")]
[InlineData("http://sub.sub.domain", "http://*.domain")]