@jaypie/express 1.2.5 → 1.2.6

package/dist/cjs/index.cjs

@@ -151,7 +151,8 @@ function buildQueryFromMultiValue(multiValueParams) {
         const existingValues = result[key];
         if (existingValues === undefined) {
             // First occurrence - use array if multiple values or bracket notation
-            result[key] = values.length === 1 && !rawKey.endsWith("[]") ? values[0] : values;
+            result[key] =
+                values.length === 1 && !rawKey.endsWith("[]") ? values[0] : values;
         }
         else if (Array.isArray(existingValues)) {
             existingValues.push(...values);
@@ -1049,7 +1050,9 @@ function createLambdaHandler(app, _options) {
                         {
                             status: 500,
                             title: "Internal Server Error",
-                            detail: error instanceof Error ? error.message : "Unknown error occurred",
+                            detail: error instanceof Error
+                                ? error.message
+                                : "Unknown error occurred",
                         },
                     ],
                 }),
@@ -1136,6 +1139,33 @@ const ensureProtocol = (url) => {
         return url;
     return HTTPS_PROTOCOL + url;
 };
+const extractHostname = (origin) => {
+    try {
+        const url = new URL(origin);
+        return url.hostname;
+    }
+    catch {
+        return undefined;
+    }
+};
+const isOriginAllowed = (requestOrigin, allowed) => {
+    const normalizedAllowed = ensureProtocol(allowed);
+    const normalizedRequest = ensureProtocol(requestOrigin);
+    const allowedHostname = extractHostname(normalizedAllowed);
+    const requestHostname = extractHostname(normalizedRequest);
+    if (!allowedHostname || !requestHostname) {
+        return false;
+    }
+    // Exact match
+    if (requestHostname === allowedHostname) {
+        return true;
+    }
+    // Subdomain match
+    if (requestHostname.endsWith(`.${allowedHostname}`)) {
+        return true;
+    }
+    return false;
+};
 const dynamicOriginCallbackHandler = (origin) => {
     return (requestOrigin, callback) => {
         // Handle wildcard origin
@@ -1169,7 +1199,7 @@ const dynamicOriginCallbackHandler = (origin) => {
             if (allowed instanceof RegExp) {
                 return allowed.test(requestOrigin);
             }
-            return requestOrigin.includes(allowed);
+            return isOriginAllowed(requestOrigin, allowed);
         });
         if (isAllowed) {
             callback(null, true);
@@ -1440,7 +1470,7 @@ const logger$1 = logger$2.log;
  * Uses Symbol marker to survive prototype chain modifications from Express and dd-trace.
  */
 function isLambdaMockResponse(res) {
-    return res[JAYPIE_LAMBDA_MOCK] === true;
+    return (res[JAYPIE_LAMBDA_MOCK] === true);
 }
 /**
  * Safely send a JSON response, avoiding dd-trace interception.