microsoft / microsoft/ApplicationInsights-JS

CorrelationHeaderDomains and CorrelationHeaderExcludedDomains has bad matchers

Open
#2,456 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
685
Forks
261
Avg merge
21h 33m
Merged PRs (30d)
5

Description

The domain name in the include list is compared as a contains and not a complete match even when not including wildcards.

https://github.com/microsoft/ApplicationInsights-JS/blob/2d5271bd125aba8fadb85b85d51508eb33f080bf/shared/AppInsightsCore/src/utils/Util.ts#L87

I'm not sure its worthy of a security thing, as this is just correlations and set in frontend code, but it seems like a bug that may trip someone up. Either the lists should take in a real regex or the matching logic should be tightened.

Both the include and exclude lists are "contains" (and may contain (some) regex...)

```json5
{
correlationHeaderDomains: ['day.example.com', 'bar.net'],
correlationHeaderExcludedDomains: ['bar.example.com', '[a-z0-9]+.example.net'],
}
```

`day.example.com` will also match `monday.example.com` (and `day.example.com.otherdomain.net`)
`bar.net` will also match `foobar.net`

the same with excludedDomains where `bar.example.com` will exclude `foobar.example.com`. (and `bar.example.com.otherdomain.net`)

The semi regex will work, but not if it contains a backwards slash or a `.`.

I would suggest making the existing ones match exact domain if there is no wildcard at start. And I would create a regex overload for both so we can use real regexes to match.

Contributor guide

Open the contributing guide

Research direction

Start in shared/AppInsightsCore/src/utils/Util.ts around line 87 and trace how correlationHeaderDomains and correlationHeaderExcludedDomains are matched. Compare the listed domain examples with the current contains and semi-regex behavior, then settle the intended wildcard and regex semantics. Done means both lists match or exclude only according to those documented semantics, with coverage for the examples in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
frontend, observability
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.