Skip to content

Fix cors allowed origin pattern matching #4008

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
joemahady-comm wants to merge 4 commits into
base: develop
Choose a base branch
from
+91 −37
Draft

Fix cors allowed origin pattern matching #4008

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b50b059
Implement AI Scan -- MEDIUM -- cors-allowed-origin-patterns-matched-w…
joemahady-comm Jul 29, 2026
c0c9ec0
Fix tests failing after CorsFilter changes
joemahady-comm Aug 7, 2026
508b647
Fix cors allowed origin pattern matching
joemahady-comm Aug 7, 2026
0b4dfa3
Fix concurrent modification in CorsFilter
joemahady-comm Aug 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions docs/UAA-Configuration-Reference.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2264,6 +2264,9 @@ Regex patterns for URIs that allow CORS requests (non-XHR). Default permits all.

Regex patterns for allowed CORS origins (non-XHR).

**Note:** Origin patterns are evaluated as full-string matches (they are implicitly anchored with `^` and `$`). If you previously relied on substring matching, you must update your patterns.
For example, to safely match a domain with any subdomain and an optional port, use a pattern like: `^https?://([a-zA-Z0-9-]+\.)*example\.com(:[0-9]+)?$`

[Back to table](#cors)

---
Expand Down Expand Up @@ -2336,6 +2339,9 @@ Regex patterns for URIs that allow XHR CORS requests.

Regex patterns for allowed XHR CORS origins.

**Note:** Origin patterns are evaluated as full-string matches (they are implicitly anchored with `^` and `$`). If you previously relied on substring matching, you must update your patterns.
For example, to safely match a domain with any subdomain and an optional port, use a pattern like: `^https?://([a-zA-Z0-9-]+\.)*example\.com(:[0-9]+)?$`

[Back to table](#cors)

---
Expand Down
25 changes: 23 additions & 2 deletions model/src/main/java/org/cloudfoundry/identity/uaa/zone/CorsConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,14 +34,14 @@ public class CorsConfiguration {
* requests.
*/
private List<String> allowedOrigins = Collections.singletonList(".*");
private final List<Pattern> allowedOriginPatterns = new ArrayList<>();
private List<Pattern> allowedOriginPatterns = new ArrayList<>();

/**
* A comma delimited list of regular expression patterns that defines which
* UAA URIs allow the "X-Requested-With" header in CORS requests.
*/
private List<String> allowedUris = Collections.singletonList(".*");
private final List<Pattern> allowedUriPatterns = new ArrayList<>();
private List<Pattern> allowedUriPatterns = new ArrayList<>();

/**
* A comma delimited list of regular expression patterns that define which
Expand All @@ -60,6 +60,17 @@ public boolean isAllowedCredentials() {
return allowedCredentials;
}

@com.fasterxml.jackson.annotation.JsonIgnore
private volatile boolean patternsCompiled = false;

public boolean isPatternsCompiled() {
return patternsCompiled;
}

public void setPatternsCompiled(boolean patternsCompiled) {
this.patternsCompiled = patternsCompiled;
}

public void setAllowedCredentials(boolean allowedCredentials) {
this.allowedCredentials = allowedCredentials;
}
Expand All @@ -84,24 +95,34 @@ public List<Pattern> getAllowedOriginPatterns() {
return allowedOriginPatterns;
}

public void setAllowedOriginPatterns(List<Pattern> allowedOriginPatterns) {
this.allowedOriginPatterns = allowedOriginPatterns;
}

public List<String> getAllowedOrigins() {
return allowedOrigins;
}

public void setAllowedOrigins(List<String> allowedOrigins) {
this.allowedOrigins = allowedOrigins;
this.patternsCompiled = false;
}

public List<Pattern> getAllowedUriPatterns() {
return allowedUriPatterns;
}

public void setAllowedUriPatterns(List<Pattern> allowedUriPatterns) {
this.allowedUriPatterns = allowedUriPatterns;
}

public List<String> getAllowedUris() {
return allowedUris;
}

public void setAllowedUris(List<String> allowedUris) {
this.allowedUris = allowedUris;
this.patternsCompiled = false;
}

public int getMaxAge() {
Expand Down
63 changes: 45 additions & 18 deletions server/src/main/java/org/cloudfoundry/identity/uaa/security/web/CorsFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
Expand Down Expand Up @@ -112,8 +113,7 @@ public CorsFilter(final IdentityZoneManager identityZoneManager,
public void initialize() {
// initialize the configs for default zone
for (CorsConfiguration configuration : Arrays.asList(xhrConfiguration, defaultConfiguration)) {
configuration.getAllowedUriPatterns().clear();
configuration.getAllowedOriginPatterns().clear();
configuration.setPatternsCompiled(false);
compileAllowedOriginsAndUris(configuration,
configuration == xhrConfiguration ? "xhr" : "default");
}
Expand Down Expand Up @@ -324,7 +324,7 @@ protected boolean isAllowedRequestUri(final String uri, CorsConfiguration config
protected boolean isAllowedOrigin(final String origin, CorsConfiguration configuration) {
for (Pattern pattern : configuration.getAllowedOriginPatterns()) {
// Making sure that the pattern matches
if (pattern.matcher(origin).find()) {
if (pattern.matcher(origin).matches()) {
return true;
}
}
Expand Down Expand Up @@ -366,26 +366,53 @@ private CorsConfiguration resolveDefaultCorsConfiguration() {
return getDefaultConfiguration();
}

private String anchorPattern(String pattern) {
if (!pattern.startsWith("^")) {
pattern = "^" + pattern;
}
if (!pattern.endsWith("$")) {
pattern = pattern + "$";
}
return pattern;
}
Comment on lines +369 to +377

@joemahady-comm joemahady-comm Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated the configuration references for both cors.default.allowed.origins and cors.xhr.allowed.origins. Added a note to clarify that these origin patterns are evaluated as full-string matches (implicitly anchored with ^ and $). Included a helpful regex example for securely matching subdomains and optional ports (^https?://([a-zA-Z0-9-]+.)*example.com(:[0-9]+)?$).

Question as this is a document update and potential breaking change for operators how is it handled?


private void compileAllowedOriginsAndUris(CorsConfiguration configuration, String type) {
if (configuration.getAllowedUris() != null) {
for (String allowedUri : configuration.getAllowedUris()) {
try {
configuration.getAllowedUriPatterns().add(Pattern.compile(allowedUri));
log.debug("URI '%s' is allowed for a %s CORS requests.".formatted(allowedUri, type));
} catch (PatternSyntaxException patternSyntaxException) {
log.error("Invalid regular expression pattern in cors.{}.allowed.uris: {}", type, allowedUri, patternSyntaxException);
if (configuration.isPatternsCompiled()) {
return;
}

synchronized (configuration) {
if (configuration.isPatternsCompiled()) {
return;
}

List<Pattern> uriPatterns = new ArrayList<>();
if (configuration.getAllowedUris() != null) {
for (String allowedUri : configuration.getAllowedUris()) {
try {
uriPatterns.add(Pattern.compile(allowedUri));
log.debug("URI '%s' is allowed for a %s CORS requests.".formatted(allowedUri, type));
} catch (PatternSyntaxException patternSyntaxException) {
log.error("Invalid regular expression pattern in cors.{}.allowed.uris: {}", type, allowedUri, patternSyntaxException);
}
}
}
}
if (configuration.getAllowedOrigins() != null) {
for (String allowedOrigin : configuration.getAllowedOrigins()) {
try {
configuration.getAllowedOriginPatterns().add(Pattern.compile(allowedOrigin));
log.debug("Origin '%s' is allowed for a %s CORS requests.".formatted(allowedOrigin, type));
} catch (PatternSyntaxException patternSyntaxException) {
log.error("Invalid regular expression pattern in cors.{}.allowed.origins: {}", type, allowedOrigin, patternSyntaxException);
configuration.setAllowedUriPatterns(uriPatterns);

List<Pattern> originPatterns = new ArrayList<>();
if (configuration.getAllowedOrigins() != null) {
for (String allowedOrigin : configuration.getAllowedOrigins()) {
try {
originPatterns.add(Pattern.compile(anchorPattern(allowedOrigin)));
log.debug("Origin '%s' is allowed for a %s CORS requests.".formatted(allowedOrigin, type));
} catch (PatternSyntaxException patternSyntaxException) {
log.error("Invalid regular expression pattern in cors.{}.allowed.origins: {}", type, allowedOrigin, patternSyntaxException);
}
}
}
configuration.setAllowedOriginPatterns(originPatterns);

configuration.setPatternsCompiled(true);
}
}

Expand Down
16 changes: 8 additions & 8 deletions ...c/test/java/org/cloudfoundry/identity/uaa/security/web/CorsFilterNonDefaultZoneTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,8 +92,8 @@ void requestExpectXhrCorsResponse() throws Exception {

@Test
void requestWithAllowedOriginPatterns() throws Exception {
identityZone.getConfig().getCorsPolicy().getXhrConfiguration().getAllowedOriginPatterns()
.add(Pattern.compile("bunnyoutlet-shop.com$"));
identityZone.getConfig().getCorsPolicy().getXhrConfiguration().getAllowedOrigins()
.add("^.*bunnyoutlet-shop\\.com$");

MockHttpServletRequest request = new MockHttpServletRequest("GET", "/uaa/userinfo");
request.addHeader("Origin", "bunnyoutlet-shop.com");
Expand All @@ -105,8 +105,8 @@ void requestWithAllowedOriginPatterns() throws Exception {

@Test
void requestWithAllowedUriPatterns() throws Exception {
identityZone.getConfig().getCorsPolicy().getXhrConfiguration().getAllowedUriPatterns()
.add(Pattern.compile("/uaa/*"));
identityZone.getConfig().getCorsPolicy().getXhrConfiguration().getAllowedUris()
.add("^/uaa/.*$");

MockHttpServletRequest request = new MockHttpServletRequest("GET", "/uaa/login");
request.addHeader("Origin", "example.com");
Expand Down Expand Up @@ -258,8 +258,8 @@ void defaultCorsExpectStandardCorsResponse() throws Exception {

@Test
void defaultCorsWithAllowedOriginPatterns() throws Exception {
identityZone.getConfig().getCorsPolicy().getDefaultConfiguration().getAllowedOriginPatterns()
.add(Pattern.compile("bunnyoutlet.com$"));
identityZone.getConfig().getCorsPolicy().getDefaultConfiguration().getAllowedOrigins()
.add("^.*bunnyoutlet\\.com$");

MockHttpServletRequest request = new MockHttpServletRequest("GET", "/uaa/userinfo");
request.addHeader("Origin", "bunnyoutlet.com");
Expand All @@ -270,8 +270,8 @@ void defaultCorsWithAllowedOriginPatterns() throws Exception {

@Test
void defaultCorsWithAllowedUriPatterns() throws Exception {
identityZone.getConfig().getCorsPolicy().getDefaultConfiguration().getAllowedUriPatterns()
.add(Pattern.compile("/uaa/*"));
identityZone.getConfig().getCorsPolicy().getDefaultConfiguration().getAllowedUris()
.add("^/uaa/.*$");

MockHttpServletRequest request = new MockHttpServletRequest("GET", "/uaa/login");
request.addHeader("Origin", "example.com");
Expand Down
8 changes: 4 additions & 4 deletions uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2172,8 +2172,8 @@ void logOutCorsPreflight() throws Exception {
*/
@Test
void logOutCorsPreflightForIdentityZone() throws Exception {
corsFilter.getFilter().setCorsXhrAllowedOrigins(asList("^localhost$", "^*\\.localhost$"));
corsFilter.getFilter().setCorsXhrAllowedUris(singletonList("^/logout.do$"));
corsFilter.getFilter().setCorsXhrAllowedOrigins(asList("^localhost$", "^.*\\.localhost$"));
corsFilter.getFilter().setCorsXhrAllowedUris(singletonList("^/logout\\.do$"));
corsFilter.getFilter().initialize();

HttpHeaders httpHeaders = new HttpHeaders();
Expand Down Expand Up @@ -2266,8 +2266,8 @@ void logOutCorsPreflightWithUnallowedOrigin() throws Exception {
@Test
void xhrCorsPreflightForNonDefaultZoneWhenZoneSpecificCorsPolicyIsNull() throws Exception {
// setting the default zone CORS policy
corsFilter.getFilter().setCorsXhrAllowedOrigins(asList("^localhost$", "^*\\.localhost$"));
corsFilter.getFilter().setCorsXhrAllowedUris(singletonList("^/logout.do$"));
corsFilter.getFilter().setCorsXhrAllowedOrigins(asList("^localhost$", "^.*\\.localhost$"));
corsFilter.getFilter().setCorsXhrAllowedUris(singletonList("^/logout\\.do$"));
corsFilter.getFilter().initialize();

// set the non default zone CORS Xhr policy to null
Expand Down
10 changes: 5 additions & 5 deletions uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcZonePathTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2622,8 +2622,8 @@ void logOutCorsPreflight(ZoneResolutionMode mode) throws Exception {
void logOutCorsPreflightForIdentityZone(ZoneResolutionMode mode) throws Exception {
String subdomain = "testzone1";
IdentityZone zone = MockMvcUtils.createOtherIdentityZone(subdomain, mockMvc, webApplicationContext, false, IdentityZoneHolder.getCurrentZoneId());
corsFilter.getFilter().setCorsXhrAllowedOrigins(asList("^localhost$", "^*\\.localhost$"));
List<String> allowedUris = mode == ZoneResolutionMode.ZONE_PATH ? asList("^/logout.do$", "^/z/[^/]+/logout.do$") : singletonList("^/logout.do$");
corsFilter.getFilter().setCorsXhrAllowedOrigins(asList("^localhost$", "^.*\\.localhost$"));
List<String> allowedUris = mode == ZoneResolutionMode.ZONE_PATH ? asList("^/logout\\.do$", "^/z/[^/]+/logout\\.do$") : singletonList("^/logout\\.do$");
corsFilter.getFilter().setCorsXhrAllowedUris(allowedUris);
corsFilter.getFilter().initialize();

Expand Down Expand Up @@ -2734,11 +2734,11 @@ void logOutCorsPreflightWithUnallowedOrigin(ZoneResolutionMode mode) throws Exce
@EnumSource(ZoneResolutionMode.class)
void xhrCorsPreflightForNonDefaultZoneWhenZoneSpecificCorsPolicyIsNull(ZoneResolutionMode mode) throws Exception {
// setting the default zone CORS policy
corsFilter.getFilter().setCorsXhrAllowedOrigins(asList("^localhost$", "^*\\.localhost$"));
corsFilter.getFilter().setCorsXhrAllowedOrigins(asList("^localhost$", "^.*\\.localhost$"));
// For ZONE_PATH mode, the request path is /z/{subdomain}/logout.do, so we need to allow that pattern
List<String> allowedUris = mode == ZoneResolutionMode.ZONE_PATH
? asList("^/logout.do$", "^/z/[^/]+/logout.do$")
: singletonList("^/logout.do$");
? asList("^/logout\\.do$", "^/z/[^/]+/logout\\.do$")
: singletonList("^/logout\\.do$");
corsFilter.getFilter().setCorsXhrAllowedUris(allowedUris);
corsFilter.getFilter().initialize();

Expand Down
Loading