fix(server): trust wildcard CORS origins (#10144)

packages/core/server/src/helper.ts

@@ -41,17 +41,12 @@ export function createResourcer(options: ApplicationOptions) {
 
 function isWhitelistedCorsOrigin(ctx: any) {
   const origin = ctx.get('origin');
-  const whitelist = getCorsWhitelist();
 
   if (!origin) {
     return false;
   }
 
-  if (!whitelist) {
-    return isTrustedOrigin(ctx, origin);
-  }
-
-  return whitelist.has('*') || whitelist.has(origin);
+  return isTrustedOrigin(ctx, origin);
 }
 
 export function resolveCorsOrigin(ctx: any) {

packages/core/utils/src/__tests__/cors.test.ts

@@ -48,6 +48,15 @@ describe('cors utils', () => {
     expect(isTrustedOrigin(ctx, 'https://evil.example')).toBe(false);
   });
 
+  it('trusts every origin when CORS_ORIGIN_WHITELIST contains an asterisk', () => {
+    process.env.CORS_ORIGIN_WHITELIST = '*';
+
+    const ctx = createContext({ host: 'example.com' });
+
+    expect(isTrustedOrigin(ctx, 'https://trusted.example')).toBe(true);
+    expect(isTrustedOrigin(ctx, 'https://evil.example')).toBe(true);
+  });
+
   it('resolves forwarded request origins and referer origins', () => {
     const ctx = createContext(
       {

packages/core/utils/src/cors.ts

@@ -53,5 +53,9 @@ export function isTrustedOrigin(ctx: OriginContext, origin: string) {
   if (isSameOrigin(ctx, origin)) {
     return true;
   }
-  return getCorsWhitelist()?.has(origin) || false;
+  const whitelist = getCorsWhitelist();
+  if (!whitelist) {
+    return false;
+  }
+  return whitelist.has('*') || whitelist.has(origin);
 }