Add strict string domain whitelisting

Author: Marcin Hoppe

dist/angular-jwt.js

@@ -148,9 +148,14 @@ angular.module('angular-jwt.interceptor', [])
         var hostname = urlUtils.urlResolve(url).hostname.toLowerCase();
         for (var i = 0; i < options.whiteListedDomains.length; i++) {
           var domain = options.whiteListedDomains[i];
-          var regexp = domain instanceof RegExp ? domain : new RegExp(domain, 'i');
-          if (hostname.match(regexp)) {
-            return true;
+          if (domain instanceof RegExp) {
+            if (hostname.match(domain)) {
+              return true;
+            }
+          } else {
+            if (hostname === domain.toLowerCase()) {
+              return true;
+            }
           }
         }
 

dist/angular-jwt.min.js

@@ -20,9 +20,14 @@ angular.module('angular-jwt.interceptor', [])
         var hostname = urlUtils.urlResolve(url).hostname.toLowerCase();
         for (var i = 0; i < options.whiteListedDomains.length; i++) {
           var domain = options.whiteListedDomains[i];
-          var regexp = domain instanceof RegExp ? domain : new RegExp(domain, 'i');
-          if (hostname.match(regexp)) {
-            return true;
+          if (domain instanceof RegExp) {
+            if (hostname.match(domain)) {
+              return true;
+            }
+          } else {
+            if (hostname === domain.toLowerCase()) {
+              return true;
+            }
           }
         }
 

src/angularJwt/services/interceptor.js

@@ -48,6 +48,8 @@ describe('interceptor', function() {
       $q.all([
         $http({url: 'http://Example.com/hello' }),
         $http({url: 'http://www.example.com/hello' }),
+        $http({url: 'http://wwwXexample.com/hello' }),
+        $http({url: 'http://whitelisted.example.com.evil.com/hello' }),
         $http({url: 'http://whitelisted.example.com/hello' })
       ]).then(function () {
         done();
@@ -59,6 +61,12 @@ describe('interceptor', function() {
       $httpBackend.expectGET('http://www.example.com/hello', function (headers) {
         return headers.Authorization === undefined;
       }).respond(200);
+      $httpBackend.expectGET('http://wwwXexample.com/hello', function (headers) {
+        return headers.Authorization === undefined;
+      }).respond(200);
+      $httpBackend.expectGET('http://whitelisted.example.com.evil.com/hello', function (headers) {
+        return headers.Authorization === undefined;
+      }).respond(200);
       $httpBackend.expectGET('http://whitelisted.example.com/hello', function (headers) {
         return headers.Authorization === 'Bearer 123';
       }).respond(200);
@@ -69,7 +77,7 @@ describe('interceptor', function() {
 
   it('should not add Authr headers to Cross Origin requests unless whitelisted with regexp', function (done) {
     module( function ($httpProvider, jwtOptionsProvider, jwtInterceptorProvider) {
-      jwtInterceptorProvider.whiteListedDomains = [/whitelisted(-pr-\d+)?\.Example\.com$/i]
+      jwtInterceptorProvider.whiteListedDomains = [/^whitelisted(-pr-\d+)?\.Example\.com$/i]
       jwtInterceptorProvider.tokenGetter = function() {
         return 123;
       }
@@ -80,6 +88,8 @@ describe('interceptor', function() {
       $q.all([
         $http({url: 'http://Example.com/hello' }),
         $http({url: 'http://www.example.com/hello' }),
+        $http({url: 'http://whitelisted-pr-123.example.com.evil.com/hello' }),
+        $http({url: 'http://extrawhitelisted-pr-123.example.com.evil.com/hello' }),
         $http({url: 'http://whitelisted-pr-123.example.com/hello' })
       ]).then(function () {
         done();
@@ -91,6 +101,12 @@ describe('interceptor', function() {
       $httpBackend.expectGET('http://www.example.com/hello', function (headers) {
         return headers.Authorization === undefined;
       }).respond(200);
+      $httpBackend.expectGET('http://whitelisted-pr-123.example.com.evil.com/hello', function (headers) {
+        return headers.Authorization === undefined;
+      }).respond(200);
+      $httpBackend.expectGET('http://extrawhitelisted-pr-123.example.com.evil.com/hello', function (headers) {
+        return headers.Authorization === undefined;
+      }).respond(200);
       $httpBackend.expectGET('http://whitelisted-pr-123.example.com/hello', function (headers) {
         return headers.Authorization === 'Bearer 123';
       }).respond(200);