Skip to content

Commit d1f2240

Browse files
RaoufGhrissid-fence
authored andcommitted
[FIX] regex not allowed for cors_origins
Steps to reproduce: Adding origins such as chrome-extension://{id} or moz-extension://{id} through the UI causes the server to crash at startup without any explanation. When trying to start the server manually, an error is displayed ``` [ERROR][panic]: thread 'main' panicked at 'Failed to set up CORS: OpaqueAllowedOrigin(["chrome-extension://{any_id}"])': aw-server/src/endpoints/cors.rs:69 ``` Source: This happens because these schemes are not valid for allowed_exact_origins and are treated as opaque origins by the CORS layer. The server currently allows any string to be inserted into: allowed_exact_origins (via cors) allowed_regex_origins (via cors_regex) However, non-HTTP schemes (chrome-extension://, moz-extension://, etc.) are invalid in allowed_exact_origins and cause a panic when initializing CORS. Solution: Short term Solution: Validate origins before inserting them into allowed_exact_origins to accept only http:// and https:// Other Solutions: 1- add a regex_cors field 2- accept regex for browser extensions and put the automatically in allowed_regex_origins
1 parent 9c12597 commit d1f2240

2 files changed

Lines changed: 3 additions & 3 deletions

File tree

aw-client-rust/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,5 @@ Cargo.lock
88

99
# These are backup files generated by rustfmt
1010
**/*.rs.bk
11+
12+
.vscode

aw-server/src/endpoints/cors.rs

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,7 @@ pub fn cors(config: &AWConfig, datastore_mutex: &Mutex<Datastore>) -> rocket_cor
2121
.filter(|s| !s.is_empty())
2222
.filter(|s| {
2323
let is_valid = s.starts_with("http://")
24-
|| s.starts_with("https://")
25-
|| s.starts_with("chrome-extension://")
26-
|| s.starts_with("moz-extension://");
24+
|| s.starts_with("https://");
2725
if !is_valid {
2826
log::warn!("Ignoring invalid CORS origin: '{}'", s);
2927
}

0 commit comments

Comments
 (0)