Fix cors allowed origin pattern matching

[joemahady-comm]

Ticket: cors-allowed-origin-patterns-matched-with-find-instead-of-matches

Fix: Updated the CorsFilter to anchor (^...$) operator-supplied origin patterns during compilation and transitioned from .find() to .matches() for CORS Origin evaluations, ensuring unanchored spoofed domains are rejected while retaining intended .find() URI substring behavior.

[Copilot]

Pull request overview

This PR tightens CORS origin validation in UAA by switching origin regex evaluation from substring matching to full-string matching, and by implicitly anchoring configured origin patterns during compilation to prevent spoofed domains from being accepted.

Changes:

• Updated CorsFilter to validate origins with Pattern.matcher(...).matches() and to compile allowed-origin patterns with implicit ^...$ anchoring.
• Updated login CORS MockMvc tests to use valid .* subdomain patterns for *.localhost.
• (Tests) Continued exercising zone/path variants of logout CORS preflight behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
server/src/main/java/org/cloudfoundry/identity/uaa/security/web/CorsFilter.java	Makes origin evaluation full-match and anchors configured origin regexes at compile time.
uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java	Updates CORS allowed-origin test patterns to a valid .*\\.localhost form.
uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java	Updates zone/path CORS allowed-origin test patterns to a valid .*\\.localhost form.

Comments suppressed due to low confidence (2)

uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java:2270

• The allowed URI regex uses an unescaped '.' ("^/logout.do$") which also matches unintended paths like "/logoutXdo". Escaping the dot makes the test (and example configuration) match the literal ".do" suffix only.

        corsFilter.getFilter().setCorsXhrAllowedOrigins(asList("^localhost$", "^.*\\.localhost$"));
        corsFilter.getFilter().setCorsXhrAllowedUris(singletonList("^/logout.do$"));

uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java:2741

• The allowed URI regex patterns use an unescaped '.' ("^/logout.do$", "^/z/[^/]+/logout.do$") which can match unintended URIs. Escaping the dot keeps the allowed-URI whitelist exact.

        corsFilter.getFilter().setCorsXhrAllowedOrigins(asList("^localhost$", "^.*\\.localhost$"));
        // For ZONE_PATH mode, the request path is /z/{subdomain}/logout.do, so we need to allow that pattern
        List<String> allowedUris = mode == ZoneResolutionMode.ZONE_PATH
                ? asList("^/logout.do$", "^/z/[^/]+/logout.do$")
                : singletonList("^/logout.do$");