microsoft / microsoft/ApplicationInsights-JS
CorrelationHeaderDomains and CorrelationHeaderExcludedDomains has bad matchers
- Dominant language
- TypeScript
- Stars
- 685
- Forks
- 261
- Avg merge
- 21h 33m
- Merged PRs (30d)
- 5
Description
The domain name in the include list is compared as a contains and not a complete match even when not including wildcards.
https://github.com/microsoft/ApplicationInsights-JS/blob/2d5271bd125aba8fadb85b85d51508eb33f080bf/shared/AppInsightsCore/src/utils/Util.ts#L87
I'm not sure its worthy of a security thing, as this is just correlations and set in frontend code, but it seems like a bug that may trip someone up. Either the lists should take in a real regex or the matching logic should be tightened.
Both the include and exclude lists are "contains" (and may contain (some) regex...)
```json5
{
correlationHeaderDomains: ['day.example.com', 'bar.net'],
correlationHeaderExcludedDomains: ['bar.example.com', '[a-z0-9]+.example.net'],
}
```
`day.example.com` will also match `monday.example.com` (and `day.example.com.otherdomain.net`)
`bar.net` will also match `foobar.net`
the same with excludedDomains where `bar.example.com` will exclude `foobar.example.com`. (and `bar.example.com.otherdomain.net`)
The semi regex will work, but not if it contains a backwards slash or a `.`.
I would suggest making the existing ones match exact domain if there is no wildcard at start. And I would create a regex overload for both so we can use real regexes to match.
Contributor guide
Research direction
Start in shared/AppInsightsCore/src/utils/Util.ts around line 87 and trace how correlationHeaderDomains and correlationHeaderExcludedDomains are matched. Compare the listed domain examples with the current contains and semi-regex behavior, then settle the intended wildcard and regex semantics. Done means both lists match or exclude only according to those documented semantics, with coverage for the examples in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- frontend, observability
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100