stripe / smokescreen / 37462579887

66%

Build Type

push

github

Committed by web-flow

Commit Message

acl: support single-label wildcards in domain globs (#344)

* acl: support single-label wildcards in domain globs

Domain globs only allowed a leading "*.", so patterns like access-analyzer.*.amazonaws.com (#241) or api*.example.com had to be expanded by hand, and new regions or hosts silently fell outside the list. Globs may now also contain a single wildcard that is confined to one label: either a whole non-leftmost label or a suffix after a literal prefix. Such a wildcard never crosses a dot, must be followed by a registrable domain, and is rejected in the TLD, Punycode labels, IP-shaped patterns, and directly after a leading "*" since that is usually a typo for "*.".

Outside the global deny list, a host only matches if its registrable domain per the public suffix list equals that of the glob's literal suffix. Without this, access-analyzer.*.amazonaws.com would allow access-analyzer.s3.amazonaws.com, an S3 bucket anyone can claim. The cost is that hosts the PSL splits off, like the us-east-1.amazonaws.com suffix, must be listed explicitly. The global deny list skips the check so a denied glob blocks every host it reads as.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Committed-By-Agent: claude

* acl: share label wildcard parsing between validation and matching

The matcher re-derived a label wildcard's structure on its own and only rejected some of the shapes that validation rejects, so an unvalidated glob such as 1*.0.0.1 still matched an IP address in the global deny list. Validation and matching now share one parser, and a glob only matches after passing the same checks as ValidateDomainGlob. The normalization and public suffix checks run only after the labels match, so a miss costs no more than before.

The README now also notes that hosts that are public suffixes themselves, such as regional S3 endpoints, never match a wildcard, and that denying a label wildcard covers neither the bare prefix nor subdomains.

Co-Authored-By: Clau... (continued)

Coverage Stats

123 of 133 new or added lines in 2 files covered. (92.48%)

2 existing lines in 1 file now uncovered.

2046 of 3147 relevant lines covered (65.01%)

22.67 hits per line