martini-contrib/cors — pull request #6 by tomsteele (2014-03-23 22:39:08+00:00)
Title: AllowOrigins with wildcards allows for bypass

Currently when matching the origin header of a request to AllowOrigins there is no verification to the start and end of the regex. Someone could abuse this. Consider the following example.

```
m.Use(Allow(&Options{
AllowOrigins: []string{"https://*.foo.com"},
}))
```

The intention was to only allow from a subdomain of foo.com. However, the owner of bar.com could create a record for "foo.com.bar.com", allowing for bypass of the restriction. To resolve this I borrowed a solution from the Hapi.js framework. That is first escape the filter, replace needed characters to allow for wildcards, and then adding "^" and "$" to the regex.