null/BillTracker
null
/
BillTracker
1
0
Fork 0
Code Issues 4 Pull Requests Packages Projects Releases 1 Wiki Activity

LOW: CORS_ORIGIN accepts comma-separated origins without URL validation #82

New Issue
Open
opened 2026-05-31 12:04:04 -05:00 by null · 0 comments
null commented 2026-05-31 12:04:04 -05:00
Owner
Copy Link

Bug Description

server.js:26-28 splits CORS_ORIGIN by comma and accepts any non-empty string as an allowed origin. No validation ensures these are valid URLs or match expected patterns. A typo like http://example.com vs https://example.com would silently allow the wrong origin.

Recommended Fix

Validate that each parsed origin is a valid URL with expected protocol (https in production).

## Bug Description server.js:26-28 splits CORS_ORIGIN by comma and accepts any non-empty string as an allowed origin. No validation ensures these are valid URLs or match expected patterns. A typo like http://example.com vs https://example.com would silently allow the wrong origin. ## Recommended Fix Validate that each parsed origin is a valid URL with expected protocol (https in production).
null added the
backend
priority:low
 labels 2026-05-31 12:04:04 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
dev
main
v0.24.6
v0.18
Labels
Clear labels   
architecture

   
backend

   
bug

   
feature

   
frontend

   
priority:critical

   
priority:high

   
priority:low

   
priority:medium

   
priority:nice-to-have

   
ux
No Label
architecture
backend
bug
feature
frontend
priority:critical
priority:high
priority:low
priority:medium
priority:nice-to-have
ux
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: null/BillTracker#82
No description provided.
Delete Branch "%!s(<nil>)"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?