CORS Origin : Regex Support (#378)

* santinized origins config

* fixed test case with exporting func

Author: farhanW3

src/server/middleware/cors/cors.ts

@@ -102,6 +102,32 @@ const defaultOptions = {
   strictPreflight: true,
 };
 
+export const sanitizeOrigin = (data: string): string | RegExp => {
+  if (data.startsWith("/") && data.endsWith("/")) {
+    return new RegExp(data.slice(1, -1));
+  }
+
+  if (data.startsWith("*.")) {
+    const regex = data.replace("*.", ".*.");
+    return new RegExp(regex);
+  }
+
+  if (data.includes("thirdweb-preview.com")) {
+    return new RegExp(/^https?:\/\/.*\.thirdweb-preview\.com$/);
+  }
+  if (data.includes("thirdweb-dev.com")) {
+    return new RegExp(/^https?:\/\/.*\.thirdweb-dev\.com$/);
+  }
+
+  // Remove trailing slashes.
+  // The origin header does not include a trailing slash.
+  if (data.endsWith("/")) {
+    return data.slice(0, -1);
+  }
+
+  return data;
+};
+
 export const fastifyCors = async (
   fastify: FastifyInstance,
   req: FastifyRequest,
@@ -112,7 +138,7 @@ export const fastifyCors = async (
   const config = await getConfig();
 
   const originArray = config.accessControlAllowOrigin.split(",") as string[];
-  opts.origin = originArray;
+  opts.origin = originArray.map(sanitizeOrigin);
 
   let hideOptionsRoute = true;
   if (opts.hideOptionsRoute !== undefined) {

src/server/middleware/cors/index.ts

@@ -14,29 +14,3 @@ export const withCors = async (server: FastifyInstance) => {
     );
   });
 };
-
-export const sanitizeOrigin = (data: string): string | RegExp => {
-  if (data.startsWith("/") && data.endsWith("/")) {
-    return new RegExp(data.slice(1, -1));
-  }
-
-  if (data.startsWith("*.")) {
-    const regex = data.replace("*.", ".*.");
-    return new RegExp(regex);
-  }
-
-  if (data.includes("thirdweb-preview.com")) {
-    return new RegExp(/^https?:\/\/.*\.thirdweb-preview\.com$/);
-  }
-  if (data.includes("thirdweb-dev.com")) {
-    return new RegExp(/^https?:\/\/.*\.thirdweb-dev\.com$/);
-  }
-
-  // Remove trailing slashes.
-  // The origin header does not include a trailing slash.
-  if (data.endsWith("/")) {
-    return data.slice(0, -1);
-  }
-
-  return data;
-};

src/server/routes/configuration/cors/remove.ts

@@ -48,7 +48,7 @@ export async function removeUrlToCorsConfiguration(fastify: FastifyInstance) {
       );
       if (containsMandatoryUrl) {
         throw new Error(
-          `Cannot remove mandatory URLs: ${mandatoryAllowedCorsUrls.join(",")}`,
+          `Cannot remove URLs: ${mandatoryAllowedCorsUrls.join(",")}`,
         );
       }
 

src/tests/cors.test.ts

@@ -1,4 +1,4 @@
-import { sanitizeOrigin } from "../server/middleware/cors";
+import { sanitizeOrigin } from "../server/middleware/cors/cors";
 
 describe("sanitizeOrigin", () => {
   it("with leading and trailing slashes", () => {