@trops/dash-core 0.1.507 → 0.1.508

package/dist/electron/index.js

@@ -2586,9 +2586,23 @@ function _hostMatches(host, allowedList) {
   if (!Array.isArray(allowedList) || allowedList.length === 0) return false;
   if (allowedList.includes("*")) return true;
   const lower = host.toLowerCase();
-  return allowedList.some(
-    (h) => typeof h === "string" && h.toLowerCase() === lower,
-  );
+  for (const entry of allowedList) {
+    if (typeof entry !== "string") continue;
+    const entryLower = entry.toLowerCase();
+    // Exact match.
+    if (entryLower === lower) return true;
+    // Subdomain wildcard: "*.example.com" matches "example.com" and
+    // any host ending in ".example.com". The leading dot on the
+    // suffix-test is required — otherwise "*.example.com" would also
+    // match "attackerexample.com", which is the kind of confusion
+    // this feature is meant to avoid.
+    if (entryLower.startsWith("*.")) {
+      const base = entryLower.slice(2); // "example.com"
+      if (lower === base) return true;
+      if (lower.endsWith("." + base)) return true;
+    }
+  }
+  return false;
 }
 
 function _parseHost(url) {
@@ -34789,20 +34803,13 @@ boolean.parseBooleanDef = parseBooleanDef;
 
 var branded = {};
 
-var hasRequiredBranded;
-
-function requireBranded () {
-	if (hasRequiredBranded) return branded;
-	hasRequiredBranded = 1;
-	Object.defineProperty(branded, "__esModule", { value: true });
-	branded.parseBrandedDef = void 0;
-	const parseDef_js_1 = requireParseDef();
-	function parseBrandedDef(_def, refs) {
-	    return (0, parseDef_js_1.parseDef)(_def.type._def, refs);
-	}
-	branded.parseBrandedDef = parseBrandedDef;
-	return branded;
+Object.defineProperty(branded, "__esModule", { value: true });
+branded.parseBrandedDef = void 0;
+const parseDef_js_1$1 = requireParseDef();
+function parseBrandedDef(_def, refs) {
+    return (0, parseDef_js_1$1.parseDef)(_def.type._def, refs);
 }
+branded.parseBrandedDef = parseBrandedDef;
 
 var _catch = {};
 
@@ -35385,7 +35392,7 @@ function requireRecord () {
 	const v3_1 = v3;
 	const parseDef_js_1 = requireParseDef();
 	const string_js_1 = string;
-	const branded_js_1 = requireBranded();
+	const branded_js_1 = branded;
 	const any_js_1 = any;
 	function parseRecordDef(def, refs) {
 	    if (refs.target === "openAi") {
@@ -36036,7 +36043,7 @@ function requireSelectParser () {
 	const array_js_1 = requireArray();
 	const bigint_js_1 = bigint;
 	const boolean_js_1 = boolean;
-	const branded_js_1 = requireBranded();
+	const branded_js_1 = branded;
 	const catch_js_1 = require_catch();
 	const date_js_1 = date;
 	const default_js_1 = require_default();
@@ -36335,7 +36342,7 @@ zodToJsonSchema$1.zodToJsonSchema = zodToJsonSchema;
 	__exportStar(requireArray(), exports);
 	__exportStar(bigint, exports);
 	__exportStar(boolean, exports);
-	__exportStar(requireBranded(), exports);
+	__exportStar(branded, exports);
 	__exportStar(require_catch(), exports);
 	__exportStar(date, exports);
 	__exportStar(require_default(), exports);