@cytario/web 2.1.7 → 2.2.0

package/app/utils/listObjectsClient.ts

@@ -0,0 +1,318 @@
+import { Sha256 } from "@aws-crypto/sha256-browser";
+import type { _Object } from "@aws-sdk/client-s3";
+import type { Credentials } from "@aws-sdk/client-sts";
+import { SignatureV4 } from "@smithy/signature-v4";
+
+import { ExpiredCredentialsError, requestCredentialsRefresh } from "./credentialsRefresh";
+import { filterObjects } from "./filterObjects";
+import { DEFAULT_MAX_TOTAL } from "./listingLimits";
+import { constructS3Url } from "./resourceId";
+import { CorsLikelyError } from "./signedFetch";
+import type { ConnectionConfig } from "~/.generated/client";
+
+const DEFAULT_PAGE_SIZE = 1000;
+
+/**
+ * RFC 3986 strict percent-encoding — matches the canonical request SigV4
+ * builds. `URLSearchParams` form-encoding instead breaks signatures on any
+ * continuation token containing `+` (base64).
+ */
+function rfc3986Encode(value: string): string {
+  return encodeURIComponent(value).replace(
+    /[!*'()]/g,
+    (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`,
+  );
+}
+
+/**
+ * Serialise a query map using the same RFC-3986 encoding the signer applies
+ * canonically, so the wire URL byte-matches what was signed.
+ */
+function encodeWireQuery(query: Record<string, string>): string {
+  return Object.entries(query)
+    .map(([key, value]) => `${rfc3986Encode(key)}=${rfc3986Encode(value)}`)
+    .join("&");
+}
+
+export interface ListObjectsClientOptions {
+  query?: string | null;
+  prefix?: string;
+  /** When true, omit Delimiter (recursive flat listing). Default: false (one-level via Delimiter "/"). */
+  recursive?: boolean;
+  /** S3 page size. Default: 1000 (S3 max). */
+  maxKeys?: number;
+  /** Hard cap on total entries (contents + commonPrefixes) collected across pages. Default: 10000. */
+  maxTotal?: number;
+  /**
+   * Short-circuits pagination as soon as any object in a fetched page
+   * satisfies the predicate. Useful for "first match wins" scans.
+   */
+  findFirst?: (obj: _Object) => boolean;
+  /** Aborts the in-flight pagination loop. */
+  signal?: AbortSignal;
+}
+
+export interface ListObjectsClientResult {
+  contents: _Object[];
+  commonPrefixes: string[];
+  isCapped: boolean;
+}
+
+function getElText(parent: Element, tag: string): string | undefined {
+  const el = parent.getElementsByTagName(tag)[0];
+  return el?.textContent ?? undefined;
+}
+
+function parseListResponse(xml: string): {
+  contents: _Object[];
+  commonPrefixes: string[];
+  isTruncated: boolean;
+  nextContinuationToken: string | undefined;
+} {
+  const doc = new DOMParser().parseFromString(xml, "text/xml");
+  const root = doc.documentElement;
+  if (!root) {
+    throw new Error("Failed to parse ListBucketResult XML");
+  }
+
+  // Firefox injects `<parsererror>` as a child rather than replacing the root,
+  // so the nodeName check is insufficient.
+  if (doc.getElementsByTagName("parsererror").length > 0) {
+    throw new Error("Failed to parse ListBucketResult XML");
+  }
+
+  if (root.nodeName !== "ListBucketResult") {
+    const code = doc.getElementsByTagName("Code")[0]?.textContent;
+    const message = doc.getElementsByTagName("Message")[0]?.textContent;
+    throw new Error(`S3 error: ${code ?? "Unknown"} ${message ?? ""}`.trimEnd());
+  }
+
+  const contents: _Object[] = Array.from(root.getElementsByTagName("Contents")).map((node) => {
+    const sizeText = getElText(node, "Size");
+    const lastModified = getElText(node, "LastModified");
+    return {
+      Key: getElText(node, "Key") ?? "",
+      LastModified: lastModified ? new Date(lastModified) : undefined,
+      ETag: getElText(node, "ETag"),
+      Size: sizeText !== undefined ? Number(sizeText) : undefined,
+      StorageClass: getElText(node, "StorageClass"),
+    } as _Object;
+  });
+
+  const commonPrefixes: string[] = Array.from(root.getElementsByTagName("CommonPrefixes"))
+    .map((node) => getElText(node, "Prefix") ?? "")
+    .filter(Boolean);
+
+  return {
+    contents,
+    commonPrefixes,
+    isTruncated: getElText(root, "IsTruncated") === "true",
+    nextContinuationToken: getElText(root, "NextContinuationToken"),
+  };
+}
+
+async function signedListBucketRequest({
+  credentials,
+  region,
+  bucketUrl,
+  query,
+  signal,
+}: {
+  credentials: Credentials;
+  region: string;
+  bucketUrl: string;
+  query: Record<string, string>;
+  signal?: AbortSignal;
+}): Promise<Response> {
+  if (!credentials.AccessKeyId || !credentials.SecretAccessKey) {
+    throw new Error("Invalid credentials: AccessKeyId and SecretAccessKey are required");
+  }
+
+  const signer = new SignatureV4({
+    credentials: {
+      accessKeyId: credentials.AccessKeyId,
+      secretAccessKey: credentials.SecretAccessKey,
+      sessionToken: credentials.SessionToken,
+    },
+    region,
+    service: "s3",
+    sha256: Sha256,
+    // S3 paths are pre-encoded; the signer must not double-encode them.
+    uriEscapePath: false,
+  });
+
+  const parsed = new URL(bucketUrl);
+
+  const signed = await signer.sign({
+    method: "GET",
+    protocol: parsed.protocol,
+    hostname: parsed.hostname,
+    port: parsed.port ? parseInt(parsed.port) : undefined,
+    path: parsed.pathname,
+    query,
+    headers: { host: parsed.host },
+  });
+
+  const wireQuery = encodeWireQuery(query);
+  const wireUrl = `${parsed.origin}${parsed.pathname}?${wireQuery}`;
+
+  const browserOrigin =
+    typeof window !== "undefined" && typeof window.location?.origin === "string"
+      ? window.location.origin
+      : "";
+  try {
+    return await fetch(wireUrl, {
+      method: "GET",
+      headers: signed.headers as Record<string, string>,
+      signal,
+      // Block redirect-following — `fetch` would otherwise re-send the
+      // Authorization header (and the STS token) to whatever host the 30x
+      // points at.
+      redirect: "error",
+    });
+  } catch (error) {
+    if (isLikelyCorsFailure(error)) {
+      throw new CorsLikelyError(parsed.host, browserOrigin, error);
+    }
+    throw error;
+  }
+}
+
+function isLikelyCorsFailure(error: unknown): boolean {
+  if (!(error instanceof TypeError)) return false;
+  const message = error.message ?? "";
+  return (
+    message.includes("Failed to fetch") ||
+    message.includes("Load failed") ||
+    message.includes("NetworkError when attempting to fetch resource") ||
+    message.includes("NetworkError")
+  );
+}
+
+/**
+ * Detect expired-token bodies on a cloned response so the caller's downstream
+ * `.text()` still works. AWS: 400 + `ExpiredToken`; MinIO: 403 + `ExpiredTokenException`.
+ */
+async function isExpiredTokenResponse(response: Response): Promise<boolean> {
+  if (response.status !== 400 && response.status !== 403) return false;
+  try {
+    const body = await response.clone().text();
+    return (
+      body.includes("<Code>ExpiredToken</Code>") ||
+      body.includes("<Code>ExpiredTokenException</Code>")
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Browser-side paginated `ListObjectsV2`. On `ExpiredToken` triggers one
+ * refresh through `requestCredentialsRefresh` and retries the page; a second
+ * failure surfaces as `ExpiredCredentialsError` for the UI to prompt re-auth.
+ */
+export async function listObjectsClient(
+  connectionConfig: Pick<ConnectionConfig, "name" | "bucketName" | "region" | "endpoint">,
+  credentials: Credentials,
+  options: ListObjectsClientOptions = {},
+): Promise<ListObjectsClientResult> {
+  const {
+    query,
+    prefix,
+    recursive = false,
+    maxKeys = DEFAULT_PAGE_SIZE,
+    maxTotal = DEFAULT_MAX_TOTAL,
+    findFirst,
+    signal,
+  } = options;
+
+  const bucketUrl = constructS3Url(connectionConfig);
+  const region = connectionConfig.region || "eu-central-1";
+  const connectionName = connectionConfig.name;
+
+  let activeCredentials: Credentials = credentials;
+
+  const contents: _Object[] = [];
+  const commonPrefixes: string[] = [];
+  let continuationToken: string | undefined;
+  let isCapped = false;
+  let pageCount = 0;
+
+  do {
+    const queryParams: Record<string, string> = {
+      "list-type": "2",
+      "max-keys": String(maxKeys),
+    };
+    if (prefix) queryParams.prefix = prefix;
+    if (!recursive) queryParams.delimiter = "/";
+    if (continuationToken) queryParams["continuation-token"] = continuationToken;
+
+    let parsed: ReturnType<typeof parseListResponse>;
+    try {
+      let response = await signedListBucketRequest({
+        credentials: activeCredentials,
+        region,
+        bucketUrl,
+        query: queryParams,
+        signal,
+      });
+
+      if (await isExpiredTokenResponse(response)) {
+        if (!connectionName) {
+          throw new ExpiredCredentialsError(
+            "STS credentials expired and no connection name was provided to listObjectsClient.",
+          );
+        }
+        activeCredentials = await requestCredentialsRefresh(connectionName);
+        response = await signedListBucketRequest({
+          credentials: activeCredentials,
+          region,
+          bucketUrl,
+          query: queryParams,
+          signal,
+        });
+        if (await isExpiredTokenResponse(response)) {
+          throw new ExpiredCredentialsError(
+            "STS credentials expired and refresh did not yield a working session.",
+            connectionName,
+          );
+        }
+      }
+
+      if (!response.ok) {
+        throw new Error(`ListObjectsV2 failed: ${response.status} ${response.statusText}`);
+      }
+
+      // Body read + parse inside the guard so a mid-pagination failure
+      // returns a capped partial result instead of dropping prior pages.
+      const xml = await response.text();
+      parsed = parseListResponse(xml);
+    } catch (error) {
+      // ExpiredCredentialsError must escape so the UI can prompt re-auth.
+      if (error instanceof ExpiredCredentialsError) throw error;
+      if (pageCount === 0) throw error;
+      isCapped = true;
+      break;
+    }
+
+    pageCount++;
+
+    for (const obj of parsed.contents) contents.push(obj);
+    for (const cp of parsed.commonPrefixes) commonPrefixes.push(cp);
+
+    if (findFirst && contents.some(findFirst)) break;
+
+    if (contents.length + commonPrefixes.length >= maxTotal) {
+      isCapped = parsed.isTruncated;
+      break;
+    }
+
+    continuationToken = parsed.isTruncated ? parsed.nextContinuationToken : undefined;
+  } while (continuationToken);
+
+  return {
+    contents: filterObjects(contents, { query }),
+    commonPrefixes,
+    isCapped,
+  };
+}

package/app/utils/listingLimits.ts

@@ -0,0 +1,7 @@
+/** Hard cap on total entries collected across paginated `ListObjectsV2` calls. */
+export const DEFAULT_MAX_TOTAL = 10_000;
+
+/** Shared truncation message so the cap value stays in sync with `DEFAULT_MAX_TOTAL`. */
+export function formatTruncationMessage(name: string): string {
+  return `Listing for "${name}" was truncated at the ${DEFAULT_MAX_TOTAL.toLocaleString()}-entry cap. Some entries are not shown.`;
+}

package/app/utils/loadConnectionLevel.ts

@@ -0,0 +1,50 @@
+import type { Credentials } from "@aws-sdk/client-sts";
+
+import { listObjectsClient } from "./listObjectsClient";
+import { resolveConnectionPrefix } from "./pathUtils";
+import type { ConnectionConfig } from "~/.generated/client";
+import { buildLevelTree, TreeNode } from "~/components/DirectoryView/buildDirectoryTree";
+
+export interface LoadConnectionLevelArgs {
+  connectionConfig: ConnectionConfig;
+  credentials: Credentials;
+  connectionName: string;
+  /** Connection-relative path. May be empty for the bucket root. */
+  urlPath: string;
+  signal?: AbortSignal;
+}
+
+export interface LoadConnectionLevelResult {
+  nodes: TreeNode[];
+  isCapped: boolean;
+}
+
+/**
+ * One-level browser-side listing for a connection. Shared by the object-
+ * browser client loader and the lazy-tree expansion hook.
+ */
+export async function loadConnectionLevel({
+  connectionConfig,
+  credentials,
+  connectionName,
+  urlPath: rawUrlPath,
+  signal,
+}: LoadConnectionLevelArgs): Promise<LoadConnectionLevelResult> {
+  const { urlPath, prefix } = resolveConnectionPrefix(connectionConfig.prefix, rawUrlPath);
+
+  const { contents, commonPrefixes, isCapped } = await listObjectsClient(
+    connectionConfig,
+    credentials,
+    { prefix, signal },
+  );
+
+  const nodes = buildLevelTree({
+    contents,
+    commonPrefixes,
+    connectionName,
+    prefix,
+    urlPath,
+  });
+
+  return { nodes, isCapped };
+}

package/app/utils/localFilesStore/useFileStore.ts

@@ -8,7 +8,6 @@ import {
 import { create } from "zustand";
 import { devtools } from "zustand/middleware";
 
-// Create a custom IndexedDB store for file cache
 const idbStore = createIdBStore("file-cache", "files");
 
 export interface DownloadProgress {
@@ -47,7 +46,6 @@ export const useFileStore = create<FileStore>()(
       saveFile: async (id: string, data: Uint8Array) => {
         await idbSet(id, data, idbStore);
 
-        // Mark as complete
         set(
           (state) => ({
             files: {
@@ -105,7 +103,6 @@ export const useFileStore = create<FileStore>()(
       hydrate: async () => {
         const allKeys = await idbKeys<string>(idbStore);
 
-        // Get sizes for all files
         const filesWithSizes = await Promise.all(
           allKeys.map(async (key) => {
             const data = await idbGet<Uint8Array>(key, idbStore);
@@ -120,7 +117,6 @@ export const useFileStore = create<FileStore>()(
           (state) => {
             const files = { ...state.files };
 
-            // Add any keys from IndexedDB that aren't in the store
             for (const { key, size } of filesWithSizes) {
               if (!files[key]) {
                 files[key] = {
@@ -134,7 +130,6 @@ export const useFileStore = create<FileStore>()(
               }
             }
 
-            // Remove any keys from store that aren't in IndexedDB
             for (const key of Object.keys(files)) {
               if (!allKeys.includes(key)) {
                 delete files[key];
@@ -148,6 +143,6 @@ export const useFileStore = create<FileStore>()(
         );
       },
     }),
-    { name },
+    { name, enabled: process.env.NODE_ENV !== "production" },
   ),
 );

package/app/utils/pathUtils.ts

@@ -1,3 +1,14 @@
+import { z } from "zod";
+
+/**
+ * Reject NUL / CR / LF (illegal in S3 keys, common smuggling chars) and
+ * oversized inputs. `..` traversal is checked by `resolveConnectionPrefix`.
+ */
+export const prefixSchema = z
+  .string()
+  .max(1024, "Prefix exceeds 1024 characters")
+  .regex(/^[^\0\r\n]*$/, "Prefix contains illegal control characters");
+
 export function getPrefix(path?: string) {
   if (!path) return undefined;
   if (path.endsWith("/")) return path;
@@ -8,3 +19,57 @@ export function getName(path?: string, bucketName?: string): string {
   if (!path) return bucketName ?? "";
   return path.split("/").pop() ?? "";
 }
+
+/** Thrown when a caller-supplied prefix escapes the connection's `prefix` boundary. */
+export class ConnectionPrefixError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ConnectionPrefixError";
+  }
+}
+
+export interface ResolvedConnectionPrefix {
+  /** Normalized path relative to the connection root (no leading/trailing slash). */
+  urlPath: string;
+  /** Full S3 key path: `${connPrefix}/${urlPath}` with redundant slashes squashed. */
+  pathName: string;
+  /** S3 listing prefix — `pathName` with a trailing slash, or `undefined` for bucket root. */
+  prefix: string | undefined;
+}
+
+/**
+ * Compose the S3 listing prefix, asserting `rawUrlPath` stays under
+ * `connPrefix`. Defense in depth above STS / bucket policy. Throws
+ * `ConnectionPrefixError` on `..` segments or out-of-prefix paths.
+ */
+export function resolveConnectionPrefix(
+  connPrefix: string | null | undefined,
+  rawUrlPath: string,
+): ResolvedConnectionPrefix {
+  const segments = rawUrlPath.split("/");
+  for (const seg of segments) {
+    if (seg === "..") {
+      throw new ConnectionPrefixError("Path traversal '..' is not allowed in prefix");
+    }
+  }
+
+  const urlPath = segments.filter((s) => s !== "" && s !== ".").join("/");
+
+  const normalizedConnPrefix = (connPrefix ?? "").replace(/^\/+|\/+$/g, "");
+
+  const pathName = normalizedConnPrefix
+    ? urlPath
+      ? `${normalizedConnPrefix}/${urlPath}`
+      : normalizedConnPrefix
+    : urlPath;
+
+  if (normalizedConnPrefix && !pathName.startsWith(normalizedConnPrefix)) {
+    throw new ConnectionPrefixError("Resolved path escapes connection prefix");
+  }
+
+  return {
+    urlPath,
+    pathName,
+    prefix: getPrefix(pathName),
+  };
+}

package/app/utils/resourceId.ts

@@ -19,10 +19,7 @@ export function parseResourceId(resourceId: string): ResourceIdParts {
 
   const connectionName = resourceId.slice(0, slashIndex);
 
-  const pathName = resourceId
-    .slice(slashIndex + 1)
-    // Strip leading slash
-    .replace(/^\/+/, "");
+  const pathName = resourceId.slice(slashIndex + 1).replace(/^\/+/, "");
 
   if (!connectionName) {
     throw new Error(`Invalid resourceId: "${resourceId}" — empty connectionName`);
@@ -46,38 +43,26 @@ export function buildConnectionPath(connectionName: string, pathName: string): s
 }
 
 /**
- * Builds the HTTPS URL for a full S3 object key. Always path-style — works
- * for every bucket shape (including dotted names, which break the vhost
- * wildcard cert) and keeps a single URL form across AWS and S3-compatible
- * endpoints. Path segments are URI-encoded — callers pass raw keys.
- *
- * The `s3Key` is the **full object key including any connection prefix**.
- * If you have a prefix-relative `pathName` and a resourceId, use
- * `selectHttpsUrl` / `resolveResourceId` — they rejoin the prefix for you.
- *
- * @example
- * // AWS:
- * constructS3Url({ bucketName: "my-bucket", region: "eu-central-1" }, "data/image.ome.tif")
- * // → "https://s3.eu-central-1.amazonaws.com/my-bucket/data/image.ome.tif"
- *
- * @example
- * // MinIO / R2 custom endpoint:
- * constructS3Url({ bucketName: "b", endpoint: "http://localhost:9000" }, "x.zarr")
- * // → "http://localhost:9000/b/x.zarr"
+ * Build the HTTPS URL for an S3 bucket or object. Always path-style (dotted
+ * bucket names break the vhost wildcard cert). `s3Key` is the full object
+ * key including any connection prefix; pass `""` for the bucket-level URL.
+ * Callers pass raw keys — path segments are URI-encoded internally.
  */
-export function constructS3Url(connectionConfig: ConnectionConfig, s3Key: string): string {
+export function constructS3Url(
+  connectionConfig: Pick<ConnectionConfig, "bucketName" | "region" | "endpoint">,
+  s3Key: string = "",
+): string {
   const bucket = connectionConfig.bucketName;
-  const encodedPath = s3Key.split("/").map(encodeURIComponent).join("/");
-
   const region = connectionConfig.region || "eu-central-1";
   const endpoint = connectionConfig.endpoint?.replace(/\/$/, "");
 
   const isAwsEndpoint = !endpoint || /\.amazonaws\.com$/i.test(endpoint);
+  const origin = isAwsEndpoint ? `https://s3.${region}.amazonaws.com` : endpoint;
 
-  // TODO: Check if this can be fixed on db-level
-  if (isAwsEndpoint) {
-    return `https://s3.${region}.amazonaws.com/${bucket}/${encodedPath}`;
+  if (!s3Key) {
+    return `${origin}/${bucket}`;
   }
 
-  return `${endpoint}/${bucket}/${encodedPath}`;
+  const encodedPath = s3Key.split("/").map(encodeURIComponent).join("/");
+  return `${origin}/${bucket}/${encodedPath}`;
 }

package/app/utils/s3HostAllowlist.ts

@@ -0,0 +1,116 @@
+/**
+ * Shared S3-host allowlist used by the CSP `connect-src` builder and the
+ * connection schema / CORS preflight probe.
+ *
+ * `CYTARIO_ALLOWED_S3_HOSTS` REPLACES the defaults entirely — deployers
+ * who want defaults plus extras must include them explicitly.
+ */
+
+export const DEFAULT_S3_HOSTS = ["https://*.amazonaws.com", "https://*.cytario.com"];
+
+// `process.env` as a default param crashes in the browser the moment zod
+// invokes `isAllowedS3Host` from form validation.
+const readProcessEnv = (): Record<string, string | undefined> => {
+  if (typeof process !== "undefined" && process.env) return process.env;
+  return {};
+};
+
+/**
+ * Accept `https://host[:port]` and `https://*.host[:port]`. Only a leading
+ * `*.` wildcard label is allowed — embedded `*` would smuggle a permissive
+ * pattern past validation.
+ */
+const isWellFormedAllowlistEntry = (entry: string): boolean => {
+  if (!entry.startsWith("https://")) return false;
+  const rest = entry.slice("https://".length);
+  if (rest.length === 0) return false;
+
+  // URL parser balks on `*.` patterns, so split manually.
+  if (/[/?#]/.test(rest)) return false;
+
+  const [hostPart, portPart, ...extra] = rest.split(":");
+  if (extra.length > 0) return false;
+  if (portPart !== undefined && !/^\d+$/.test(portPart)) return false;
+
+  if (hostPart.length === 0) return false;
+
+  const labels = hostPart.split(".");
+  for (let i = 0; i < labels.length; i++) {
+    const label = labels[i];
+    if (label.length === 0) return false;
+    if (label === "*") {
+      if (i !== 0) return false;
+      continue;
+    }
+    if (!/^[a-zA-Z0-9-]+$/.test(label)) return false;
+  }
+  return true;
+};
+
+/**
+ * Comma-separated `CYTARIO_ALLOWED_S3_HOSTS` overrides `DEFAULT_S3_HOSTS`
+ * entirely. Malformed entries are dropped with a `console.warn`.
+ */
+export function getAllowedS3Hosts(
+  env: Record<string, string | undefined> = readProcessEnv(),
+): string[] {
+  const raw = env.CYTARIO_ALLOWED_S3_HOSTS ?? "";
+  const trimmed = raw.trim();
+  if (trimmed.length === 0) {
+    return [...DEFAULT_S3_HOSTS];
+  }
+  const overrides = trimmed
+    .split(",")
+    .map((s) => s.trim())
+    .filter((s) => s.length > 0)
+    .filter((entry) => {
+      if (isWellFormedAllowlistEntry(entry)) return true;
+      console.warn(`[s3HostAllowlist] Ignoring malformed CYTARIO_ALLOWED_S3_HOSTS entry: ${entry}`);
+      return false;
+    });
+  return overrides;
+}
+
+// `*.example.com` matches `foo.example.com` but not the bare parent, matching
+// browser CORS / cookie rules.
+const hostnameMatchesPattern = (hostname: string, patternHostname: string): boolean => {
+  if (patternHostname.startsWith("*.")) {
+    const suffix = patternHostname.slice(1);
+    return hostname.endsWith(suffix) && hostname.length > suffix.length;
+  }
+  return hostname === patternHostname;
+};
+
+/**
+ * https-only by design — the schema's dev http carve-out for localhost
+ * does not flow through here so the SSRF surface stays narrow.
+ */
+export function isAllowedS3Host(
+  url: string,
+  env: Record<string, string | undefined> = readProcessEnv(),
+): boolean {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "https:") return false;
+
+  const allowed = getAllowedS3Hosts(env);
+  for (const entry of allowed) {
+    let pattern: URL;
+    try {
+      pattern = new URL(entry);
+    } catch {
+      continue;
+    }
+    if (pattern.protocol !== "https:") continue;
+    // Pattern with no port matches any port; with a port, exact match required.
+    if (pattern.port && pattern.port !== parsed.port) continue;
+    if (hostnameMatchesPattern(parsed.hostname, pattern.hostname)) {
+      return true;
+    }
+  }
+  return false;
+}