Skip to content

Fix an issue with CORS when a preflight request has an empty headers list #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
edwin-huber merged 1 commit into from
Jul 14, 2018
Merged

Fix an issue with CORS when a preflight request has an empty headers list #30

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 22 additions & 9 deletions lib/middleware/blob/cors.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,25 @@ const BbPromise = require('bluebird'),
Operations = require('./../../core/Constants').Operations,
sm = require('./../../core/blob/StorageManager');

// Returns the dict of allowed headers for a given request
function getAllowedHeaders (req) {
const request = req.azuriteRequest;
if (req.azuriteOperation === Operations.Account.PREFLIGHT_BLOB_REQUEST) {
if (request.httpProps[N.ACCESS_CONTROL_REQUEST_HEADERS] === undefined) {
return {}
} else {
return request.httpProps[N.ACCESS_CONTROL_REQUEST_HEADERS].toLowerCase().split(',')
.reduce((acc, e) => {
const key = Object.keys(e)[0];
acc[key] = e[key];
return acc;
}, {});
}
} else {
return req.headers;
}
}

// Performs CORS rule-validation iff CORS is enabled and request header 'origin' is set.
module.exports = (req, res, next) => {
BbPromise.try(() => {
Expand All @@ -18,18 +37,10 @@ module.exports = (req, res, next) => {
? request.httpProps[N.ACCESS_CONTROL_REQUEST_METHOD].toLowerCase()
: req.method.toLowerCase();

const allowedHeaders = req.azuriteOperation === Operations.Account.PREFLIGHT_BLOB_REQUEST
? request.httpProps[N.ACCESS_CONTROL_REQUEST_HEADERS].toLowerCase().split(',')
.reduce((acc, e) => {
const key = Object.keys(e)[0];
acc[key] = e[key];
return acc;
}, {})
: req.headers;
const allowedHeaders = getAllowedHeaders(req)

let valid = null;
for (const rule of response.payload.StorageServiceProperties.Cors.CorsRule) {
valid = false;
rule.AllowedOrigins = rule.AllowedOrigins.toLowerCase();
rule.AllowedMethods = rule.AllowedMethods.toLowerCase();
if (!rule.AllowedOrigins.includes(request.httpProps[N.ORIGIN]) && !rule.AllowedOrigins.includes('*')) {
Expand All @@ -40,6 +51,8 @@ module.exports = (req, res, next) => {
continue;
}

// Start at true to handle the case where allowedHeaders is an empty list
valid = true;
rule.AllowedHeaders.split(',')
.forEach((e) => {
Object.keys(allowedHeaders).forEach((requestHeader) => {
Expand Down