@cyclonedx/cdxgen 12.3.2 → 12.3.3

package/lib/server/server.js

@@ -76,23 +76,26 @@ const ALLOWED_PARAMS = [
 
 const app = connect();
 
-function isAllowedHttpHost(hostname) {
+export function isAllowedHttpHost(hostname) {
   if (!process.env.CDXGEN_ALLOWED_HOSTS) {
     return true;
   }
   if (!hostname || hasDangerousUnicode(hostname)) {
     return false;
   }
+  const normalizedHostname = hostname.toLowerCase();
   const allowHosts = process.env.CDXGEN_ALLOWED_HOSTS.split(",")
     .map((host) => host.trim())
     .filter(Boolean);
   for (const allowedHost of allowHosts) {
-    if (hostname === allowedHost) {
+    const normalizedAllowedHost = allowedHost.toLowerCase();
+    if (normalizedHostname === normalizedAllowedHost) {
       return true;
     }
     if (
-      allowedHost.startsWith("*.") &&
-      hostname.endsWith(allowedHost.slice(1))
+      normalizedAllowedHost.startsWith("*.") &&
+      normalizedHostname.length > normalizedAllowedHost.length - 1 &&
+      normalizedHostname.endsWith(`.${normalizedAllowedHost.slice(2)}`)
     ) {
       return true;
     }

package/lib/server/server.poku.js

@@ -12,7 +12,12 @@ import {
   validateAndRejectGitSource,
 } from "../helpers/source.js";
 import { isWin } from "../helpers/utils.js";
-import { getQueryParams, parseQueryString, parseValue } from "./server.js";
+import {
+  getQueryParams,
+  isAllowedHttpHost,
+  parseQueryString,
+  parseValue,
+} from "./server.js";
 
 function nullProtoObj(obj) {
   if (obj === null || typeof obj !== "object") {
@@ -171,6 +176,36 @@ describe("isAllowedHost()", () => {
   });
 });
 
+describe("isAllowedHttpHost()", () => {
+  let originalAllowedHosts;
+
+  beforeEach(() => {
+    originalAllowedHosts = process.env.CDXGEN_ALLOWED_HOSTS;
+  });
+
+  afterEach(() => {
+    if (originalAllowedHosts === undefined) {
+      delete process.env.CDXGEN_ALLOWED_HOSTS;
+    } else {
+      process.env.CDXGEN_ALLOWED_HOSTS = originalAllowedHosts;
+    }
+  });
+
+  it("allows exact host matches", () => {
+    process.env.CDXGEN_ALLOWED_HOSTS = "dependencytrack.example.com";
+    assert.strictEqual(isAllowedHttpHost("dependencytrack.example.com"), true);
+    assert.strictEqual(isAllowedHttpHost("other.example.com"), false);
+  });
+
+  it("allows only real subdomains for wildcard entries", () => {
+    process.env.CDXGEN_ALLOWED_HOSTS = "*.example.com";
+    assert.strictEqual(isAllowedHttpHost("api.example.com"), true);
+    assert.strictEqual(isAllowedHttpHost("deep.api.example.com"), true);
+    assert.strictEqual(isAllowedHttpHost("example.com"), false);
+    assert.strictEqual(isAllowedHttpHost("evil-example.com"), false);
+  });
+});
+
 describe("isAllowedPath()", () => {
   let originalPaths;