Skip to content

Commit cc52e2d

Browse files
lpizzinidevlpizzinidev
authored
fix(apigateway): allowedOrigins are incorrectly interpreted as regexes (#26648)
Allowed origins for CORS preflight were treated like regular expressions in the checking condition. For example, with this spec: ``` new apigateway.RestApi(this, 'api', { defaultCorsPreflightOptions: { allowOrigins: ['https://www.firstorigin.com', 'https://www.secondorigin.com'], } }) .root .addResource('hello') .addMethod('GET', new apigateway.MockIntegration({})); ``` Calling: ``` http OPTIONS https://xxx.execute-api.xxx.amazonaws.com/prod/hello "Origin: https://wwwXsecondorigin.com" ``` The response header would include the header (allowing the invalid origin from the request): ``` Access-Control-Allow-Origin: https://wwwXsecondorigin.com ``` This fix solves the issue. Closes #26623. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent ed3aaf7 commit cc52e2d

File tree

15 files changed

+1386
-5
lines changed

15 files changed

+1386
-5
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.cors-allow-multiple-origins.js.snapshot/asset.c7bba0d9d477c86c6dc2adb0eb95842634a1c040dd3a66b42eec2bb604644d4f.handler/index.d.ts

Whitespace-only changes.

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.cors-allow-multiple-origins.js.snapshot/asset.c7bba0d9d477c86c6dc2adb0eb95842634a1c040dd3a66b42eec2bb604644d4f.handler/index.js

+13
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.cors-allow-multiple-origins.js.snapshot/asset.c7bba0d9d477c86c6dc2adb0eb95842634a1c040dd3a66b42eec2bb604644d4f.handler/index.ts

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
exports.handler = async (evt: any) => {
2+
// eslint-disable-next-line no-console
3+
console.error(JSON.stringify(evt, undefined, 2));
4+
return {
5+
statusCode: 200,
6+
body: 'hello, cors!',
7+
headers: {
8+
'Access-Control-Allow-Origin': '*',
9+
},
10+
};
11+
};

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.cors-allow-multiple-origins.js.snapshot/cdk.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":"33.0.0"}

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.cors-allow-multiple-origins.js.snapshot/integ.json

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": "33.0.0",
3+
"testCases": {
4+
"integ-cors-allow-multiple-origins/DefaultTest": {
5+
"stacks": [
6+
"stack-cors-allow-multiple-origins"
7+
],
8+
"assertionStack": "integ-cors-allow-multiple-origins/DefaultTest/DeployAssert",
9+
"assertionStackName": "integcorsallowmultipleoriginsDefaultTestDeployAssertEBF0A1B1"
10+
}
11+
}
12+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.cors-allow-multiple-origins.js.snapshot/integcorsallowmultipleoriginsDefaultTestDeployAssertEBF0A1B1.assets.json

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"version": "33.0.0",
3+
"files": {
4+
"21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
5+
"source": {
6+
"path": "integcorsallowmultipleoriginsDefaultTestDeployAssertEBF0A1B1.template.json",
7+
"packaging": "file"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
}
17+
},
18+
"dockerImages": {}
19+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.cors-allow-multiple-origins.js.snapshot/integcorsallowmultipleoriginsDefaultTestDeployAssertEBF0A1B1.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.cors-allow-multiple-origins.js.snapshot/manifest.json

+177
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
{
2+
"version": "33.0.0",
3+
"artifacts": {
4+
"stack-cors-allow-multiple-origins.assets": {
5+
"type": "cdk:asset-manifest",
6+
"properties": {
7+
"file": "stack-cors-allow-multiple-origins.assets.json",
8+
"requiresBootstrapStackVersion": 6,
9+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
10+
}
11+
},
12+
"stack-cors-allow-multiple-origins": {
13+
"type": "aws:cloudformation:stack",
14+
"environment": "aws://unknown-account/unknown-region",
15+
"properties": {
16+
"templateFile": "stack-cors-allow-multiple-origins.template.json",
17+
"validateOnSynth": false,
18+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
19+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
20+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/1680a1a109d409e5d8dfb509472821013a45d099b60b8498e38e31ac2cb1562b.json",
21+
"requiresBootstrapStackVersion": 6,
22+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
23+
"additionalDependencies": [
24+
"stack-cors-allow-multiple-origins.assets"
25+
],
26+
"lookupRole": {
27+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
28+
"requiresBootstrapStackVersion": 8,
29+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
30+
}
31+
},
32+
"dependencies": [
33+
"stack-cors-allow-multiple-origins.assets"
34+
],
35+
"metadata": {
36+
"/stack-cors-allow-multiple-origins/cors-api-test/Resource": [
37+
{
38+
"type": "aws:cdk:logicalId",
39+
"data": "corsapitest8682546E"
40+
}
41+
],
42+
"/stack-cors-allow-multiple-origins/cors-api-test/Deployment/Resource": [
43+
{
44+
"type": "aws:cdk:logicalId",
45+
"data": "corsapitestDeployment2BF1633Ad72428c37c88b8c23ef39eebb5b7e9fd"
46+
}
47+
],
48+
"/stack-cors-allow-multiple-origins/cors-api-test/DeploymentStage.prod/Resource": [
49+
{
50+
"type": "aws:cdk:logicalId",
51+
"data": "corsapitestDeploymentStageprod8F31F2AB"
52+
}
53+
],
54+
"/stack-cors-allow-multiple-origins/cors-api-test/Endpoint": [
55+
{
56+
"type": "aws:cdk:logicalId",
57+
"data": "corsapitestEndpointE63606AE"
58+
}
59+
],
60+
"/stack-cors-allow-multiple-origins/cors-api-test/Default/OPTIONS/Resource": [
61+
{
62+
"type": "aws:cdk:logicalId",
63+
"data": "corsapitestOPTIONS15560589"
64+
}
65+
],
66+
"/stack-cors-allow-multiple-origins/cors-api-test/Default/my-resource/Resource": [
67+
{
68+
"type": "aws:cdk:logicalId",
69+
"data": "corsapitestmyresource73D41BDD"
70+
}
71+
],
72+
"/stack-cors-allow-multiple-origins/cors-api-test/Default/my-resource/OPTIONS/Resource": [
73+
{
74+
"type": "aws:cdk:logicalId",
75+
"data": "corsapitestmyresourceOPTIONSD5275318"
76+
}
77+
],
78+
"/stack-cors-allow-multiple-origins/cors-api-test/Default/my-resource/GET/ApiPermission.stackcorsallowmultipleoriginscorsapitestC473FAE8.GET..my-resource": [
79+
{
80+
"type": "aws:cdk:logicalId",
81+
"data": "corsapitestmyresourceGETApiPermissionstackcorsallowmultipleoriginscorsapitestC473FAE8GETmyresourceB82B6C26"
82+
}
83+
],
84+
"/stack-cors-allow-multiple-origins/cors-api-test/Default/my-resource/GET/ApiPermission.Test.stackcorsallowmultipleoriginscorsapitestC473FAE8.GET..my-resource": [
85+
{
86+
"type": "aws:cdk:logicalId",
87+
"data": "corsapitestmyresourceGETApiPermissionTeststackcorsallowmultipleoriginscorsapitestC473FAE8GETmyresource29B41ABB"
88+
}
89+
],
90+
"/stack-cors-allow-multiple-origins/cors-api-test/Default/my-resource/GET/Resource": [
91+
{
92+
"type": "aws:cdk:logicalId",
93+
"data": "corsapitestmyresourceGET844C52EA"
94+
}
95+
],
96+
"/stack-cors-allow-multiple-origins/handler/ServiceRole/Resource": [
97+
{
98+
"type": "aws:cdk:logicalId",
99+
"data": "handlerServiceRole187D5A5A"
100+
}
101+
],
102+
"/stack-cors-allow-multiple-origins/handler/Resource": [
103+
{
104+
"type": "aws:cdk:logicalId",
105+
"data": "handlerE1533BD5"
106+
}
107+
],
108+
"/stack-cors-allow-multiple-origins/BootstrapVersion": [
109+
{
110+
"type": "aws:cdk:logicalId",
111+
"data": "BootstrapVersion"
112+
}
113+
],
114+
"/stack-cors-allow-multiple-origins/CheckBootstrapVersion": [
115+
{
116+
"type": "aws:cdk:logicalId",
117+
"data": "CheckBootstrapVersion"
118+
}
119+
]
120+
},
121+
"displayName": "stack-cors-allow-multiple-origins"
122+
},
123+
"integcorsallowmultipleoriginsDefaultTestDeployAssertEBF0A1B1.assets": {
124+
"type": "cdk:asset-manifest",
125+
"properties": {
126+
"file": "integcorsallowmultipleoriginsDefaultTestDeployAssertEBF0A1B1.assets.json",
127+
"requiresBootstrapStackVersion": 6,
128+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
129+
}
130+
},
131+
"integcorsallowmultipleoriginsDefaultTestDeployAssertEBF0A1B1": {
132+
"type": "aws:cloudformation:stack",
133+
"environment": "aws://unknown-account/unknown-region",
134+
"properties": {
135+
"templateFile": "integcorsallowmultipleoriginsDefaultTestDeployAssertEBF0A1B1.template.json",
136+
"validateOnSynth": false,
137+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
138+
"cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
139+
"stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
140+
"requiresBootstrapStackVersion": 6,
141+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
142+
"additionalDependencies": [
143+
"integcorsallowmultipleoriginsDefaultTestDeployAssertEBF0A1B1.assets"
144+
],
145+
"lookupRole": {
146+
"arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
147+
"requiresBootstrapStackVersion": 8,
148+
"bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
149+
}
150+
},
151+
"dependencies": [
152+
"integcorsallowmultipleoriginsDefaultTestDeployAssertEBF0A1B1.assets"
153+
],
154+
"metadata": {
155+
"/integ-cors-allow-multiple-origins/DefaultTest/DeployAssert/BootstrapVersion": [
156+
{
157+
"type": "aws:cdk:logicalId",
158+
"data": "BootstrapVersion"
159+
}
160+
],
161+
"/integ-cors-allow-multiple-origins/DefaultTest/DeployAssert/CheckBootstrapVersion": [
162+
{
163+
"type": "aws:cdk:logicalId",
164+
"data": "CheckBootstrapVersion"
165+
}
166+
]
167+
},
168+
"displayName": "integ-cors-allow-multiple-origins/DefaultTest/DeployAssert"
169+
},
170+
"Tree": {
171+
"type": "cdk:tree",
172+
"properties": {
173+
"file": "tree.json"
174+
}
175+
}
176+
}
177+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-apigateway/test/integ.cors-allow-multiple-origins.js.snapshot/stack-cors-allow-multiple-origins.assets.json

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
{
2+
"version": "33.0.0",
3+
"files": {
4+
"c7bba0d9d477c86c6dc2adb0eb95842634a1c040dd3a66b42eec2bb604644d4f": {
5+
"source": {
6+
"path": "asset.c7bba0d9d477c86c6dc2adb0eb95842634a1c040dd3a66b42eec2bb604644d4f.handler",
7+
"packaging": "zip"
8+
},
9+
"destinations": {
10+
"current_account-current_region": {
11+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
12+
"objectKey": "c7bba0d9d477c86c6dc2adb0eb95842634a1c040dd3a66b42eec2bb604644d4f.zip",
13+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
14+
}
15+
}
16+
},
17+
"1680a1a109d409e5d8dfb509472821013a45d099b60b8498e38e31ac2cb1562b": {
18+
"source": {
19+
"path": "stack-cors-allow-multiple-origins.template.json",
20+
"packaging": "file"
21+
},
22+
"destinations": {
23+
"current_account-current_region": {
24+
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
25+
"objectKey": "1680a1a109d409e5d8dfb509472821013a45d099b60b8498e38e31ac2cb1562b.json",
26+
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
27+
}
28+
}
29+
}
30+
},
31+
"dockerImages": {}
32+
}

0 commit comments

Comments
 (0)