The domain name in the include list is compared as a contains and not a complete match even when not including wildcards.
|
const regex = new RegExp(excludedDomains[i].toLowerCase().replace(/\\/g, "\\\\").replace(/\./g, "\\.").replace(/\*/g, ".*")); |
I'm not sure its worthy of a security thing, as this is just correlations and set in frontend code, but it seems like a bug that may trip someone up. Either the lists should take in a real regex or the matching logic should be tightened.
Both the include and exclude lists are "contains" (and may contain (some) regex...)
{
correlationHeaderDomains: ['day.example.com', 'bar.net'],
correlationHeaderExcludedDomains: ['bar.example.com', '[a-z0-9]+.example.net'],
}day.example.com will also match monday.example.com (and day.example.com.otherdomain.net)
bar.net will also match foobar.net
the same with excludedDomains where bar.example.com will exclude foobar.example.com. (and bar.example.com.otherdomain.net)
The semi regex will work, but not if it contains a backwards slash or a ..
I would suggest making the existing ones match exact domain if there is no wildcard at start. And I would create a regex overload for both so we can use real regexes to match.
The domain name in the include list is compared as a contains and not a complete match even when not including wildcards.
ApplicationInsights-JS/shared/AppInsightsCore/src/utils/Util.ts
Line 87 in 2d5271b
I'm not sure its worthy of a security thing, as this is just correlations and set in frontend code, but it seems like a bug that may trip someone up. Either the lists should take in a real regex or the matching logic should be tightened.
Both the include and exclude lists are "contains" (and may contain (some) regex...)
day.example.comwill also matchmonday.example.com(andday.example.com.otherdomain.net)bar.netwill also matchfoobar.netthe same with excludedDomains where
bar.example.comwill excludefoobar.example.com. (andbar.example.com.otherdomain.net)The semi regex will work, but not if it contains a backwards slash or a
..I would suggest making the existing ones match exact domain if there is no wildcard at start. And I would create a regex overload for both so we can use real regexes to match.