feat: add regex support for origin validation in CORS configuration (#159)

* Allow regexp on AllowOrigins

* Regexp AllowOrigins requires slashes at start and end

* Merge branch 'gin-contrib/master' into feature/regexp-origin-match

# Conflicts:
#	config.go
#	cors.go

* Optimization

* Add regexp origin tests

* Fix regexp allowed origin schema check

* refactor: refactor regular expression handling in schema validation

- Define a new `regexpBasedOrigin` variable for compiling the regular expression
- Replace inline regular expression compilation with the `regexpBasedOrigin` variable in `validateAllowedSchemas` function

Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>

* refactor: simplify origin validation with precompiled regex

- Define `originRegex` as a precompiled regular expression
- Simplify origin validation logic using `originRegex`
- Remove redundant regular expression compilation and matching logic

Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>

* refactor: refactor codebase for improved readability and maintainability

- Remove `exportloopref` linter from `.golangci.yml`
- Update regex pattern in `config.go` to use backticks instead of double quotes
- Refactor `validateOrigin` function for better readability by splitting a long line into two lines

Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>

---------

Signed-off-by: Bo-Yi Wu <appleboy.tw@gmail.com>
Co-authored-by: arizz96 <arizz96@gmail.com>

Author: appleboy

.golangci.yml

@@ -7,7 +7,6 @@ linters:
     - dogsled
     - dupl
     - errcheck
-    - exportloopref
     - exhaustive
     - gochecknoinits
     - goconst

config.go

@@ -2,6 +2,7 @@ package cors
 
 import (
 	"net/http"
+	"regexp"
 	"strings"
 
 	"github.com/gin-gonic/gin"
@@ -122,21 +123,32 @@ func (cors *cors) isOriginValid(c *gin.Context, origin string) bool {
 	return valid
 }
 
+var originRegex = regexp.MustCompile(`^/(.+)/[gimuy]?$`)
+
 func (cors *cors) validateOrigin(origin string) bool {
 	if cors.allowAllOrigins {
 		return true
 	}
+
 	for _, value := range cors.allowOrigins {
-		if value == origin {
+		if !originRegex.MatchString(value) && value == origin {
+			return true
+		}
+
+		if originRegex.MatchString(value) &&
+			regexp.MustCompile(originRegex.FindStringSubmatch(value)[1]).MatchString(origin) {
 			return true
 		}
 	}
+
 	if len(cors.wildcardOrigins) > 0 && cors.validateWildcardOrigin(origin) {
 		return true
 	}
+
 	if cors.allowOriginFunc != nil {
 		return cors.allowOriginFunc(origin)
 	}
+
 	return false
 }
 

cors.go

@@ -3,6 +3,7 @@ package cors
 import (
 	"errors"
 	"fmt"
+	"regexp"
 	"strings"
 	"time"
 
@@ -103,8 +104,17 @@ func (c Config) getAllowedSchemas() []string {
 	return allowedSchemas
 }
 
+var regexpBasedOrigin = regexp.MustCompile(`^\/(.+)\/[gimuy]?$`)
+
 func (c Config) validateAllowedSchemas(origin string) bool {
 	allowedSchemas := c.getAllowedSchemas()
+
+	if regexpBasedOrigin.MatchString(origin) {
+		// Normalize regexp-based origins
+		origin = regexpBasedOrigin.FindStringSubmatch(origin)[1]
+		origin = strings.Replace(origin, "?", "", 1)
+	}
+
 	for _, schema := range allowedSchemas {
 		if strings.HasPrefix(origin, schema) {
 			return true

cors_test.go

@@ -112,6 +112,21 @@ func TestBadConfig(t *testing.T) {
 			AllowOrigins: []string{"google.com"},
 		})
 	})
+	assert.Panics(t, func() {
+		New(Config{
+			AllowOrigins: []string{"/http://google.com"},
+		})
+	})
+	assert.Panics(t, func() {
+		New(Config{
+			AllowOrigins: []string{"http?://google.com"},
+		})
+	})
+	assert.Panics(t, func() {
+		New(Config{
+			AllowOrigins: []string{"http?://google.com/g"},
+		})
+	})
 }
 
 func TestNormalize(t *testing.T) {
@@ -296,6 +311,15 @@ func TestValidateOrigin(t *testing.T) {
 	assert.True(t, cors.validateOrigin("https://google.com"))
 	assert.True(t, cors.validateOrigin("example.com"))
 	assert.True(t, cors.validateOrigin("chrome-extension://random-extension-id"))
+
+	cors = newCors(Config{
+		AllowOrigins: []string{"/https?://(?:.+\\.)?google\\.com/g"},
+	})
+	assert.True(t, cors.validateOrigin("http://google.com"))
+	assert.True(t, cors.validateOrigin("https://google.com"))
+	assert.True(t, cors.validateOrigin("https://maps.google.com"))
+	assert.True(t, cors.validateOrigin("https://maps.test.google.com"))
+	assert.False(t, cors.validateOrigin("https://maps.google.it"))
 }
 
 func TestValidateTauri(t *testing.T) {