fix(7477): OIDC host allowlist fix

Author: PavelSafronov

src/utils.ts

@@ -83,13 +83,27 @@ export function isUint8Array(value: unknown): value is Uint8Array {
  */
 export function hostMatchesWildcards(host: string, wildcards: string[]): boolean {
   for (const wildcard of wildcards) {
-    if (
-      host === wildcard ||
-      (wildcard.startsWith('*.') && host?.endsWith(wildcard.substring(2, wildcard.length))) ||
-      (wildcard.startsWith('*/') && host?.endsWith(wildcard.substring(2, wildcard.length)))
-    ) {
+    // Exact match always wins
+    if (host === wildcard) {
       return true;
     }
+
+    // Wildcard match with leading *.
+    if (wildcard.startsWith('*.')) {
+      const suffix = wildcard.substring(2);
+      // Exact match or strict subdomain match
+      if (host === suffix || host.endsWith(`.${suffix}`)) {
+        return true;
+      }
+    }
+    // Wildcard match with leading */
+    if (wildcard.startsWith('*/')) {
+      const suffix = wildcard.substring(2);
+      // Exact match or strict subpath match
+      if (host === suffix || host.endsWith(`/${suffix}`)) {
+        return true;
+      }
+    }
   }
   return false;
 }

test/unit/utils.test.ts

@@ -148,6 +148,13 @@ describe('driver utils', function () {
           });
         });
 
+        context('when the wildcard starts with *.', function () {
+          it('returns false', function () {
+            expect(hostMatchesWildcards('test-mongodb.com', ['*.mongodb.com', 'test2'])).to.be
+              .false;
+          });
+        });
+
         context('when the host matches a FQDN', function () {
           it('returns true', function () {
             expect(hostMatchesWildcards('mongodb.net', ['*.mongodb.net', 'other'])).to.be.true;
@@ -221,6 +228,14 @@ describe('driver utils', function () {
             .to.be.false;
         });
       });
+
+      context('when the host does not match partial matches', function () {
+        it('returns false', function () {
+          expect(
+            hostMatchesWildcards('/tmp/test-mongodb-27017.sock', ['*/mongodb-27017.sock', 'test2'])
+          ).to.be.false;
+        });
+      });
     });
   });