🔒 security: Enforce case-sensitive null origin validation in CORS

[Copilot]

Description

The CORS middleware was performing case-insensitive null origin validation, accepting "NULL" and "Null" variants when only the lowercase literal "null" is valid per CORS specification. This creates a potential security issue as legitimate browsers always send lowercase "null".

Changes introduced

• Security fix: Enforce case-sensitive null origin check using originHeaderRaw == "null" instead of lowercased originHeader
• Test coverage: Added validation for non-lowercase null variants ("NULL", "Null") to ensure rejection
• Test coverage: Added standalone wildcard "*" test case
• Code clarity: Improved test structure with ExpectAllowed field and renamed test case from "NullOriginAllowed" to "NullOriginLowercase"

// Before: accepted "null", "NULL", "Null", etc.
originIsNull := originHeader == "null" // originHeader is lowercased

// After: only accepts "null"
originIsNull := originHeaderRaw == "null" // case-sensitive comparison

• Documentation Update: No documentation changes required
• Changelog/What's New: Security fix for CORS null origin validation
• Migration Guide: No breaking changes
• Examples: Existing CORS examples remain valid

Type of change

• Code consistency (non-breaking change which improves code reliability and robustness)

Checklist

• Conducted a self-review of the code and provided comments for complex or critical parts.
• Added or updated unit tests to validate the effectiveness of the changes or new features.
• Ensured that new and existing unit tests pass locally with the changes.
• Aimed for optimal performance with minimal allocations in the new code.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.57%. Comparing base (4f83436) to head (5205e8e).
⚠️ Report is 13 commits behind head on add-cors-origin-validation-and-tests.

Additional details and impacted files

@@                           Coverage Diff                            @@
##           add-cors-origin-validation-and-tests    #3995      +/-   ##
========================================================================
+ Coverage                                 90.99%   91.57%   +0.58%     
========================================================================
  Files                                       119      119              
  Lines                                     10861    10271     -590     
========================================================================
- Hits                                       9883     9406     -477     
+ Misses                                      619      546      -73     
+ Partials                                    359      319      -40     

Flag	Coverage Δ
unittests	91.57% <100.00%> (+0.58%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR addresses a security vulnerability in the CORS middleware where null origin validation was case-insensitive, potentially allowing malicious requests with non-standard "NULL" or "Null" variants. The fix enforces case-sensitive validation to only accept the spec-compliant lowercase "null".

Key Changes:

• Changed null origin check from lowercased originHeader to case-sensitive originHeaderRaw
• Added comprehensive test coverage for uppercase and mixed-case null variants to ensure rejection
• Improved test structure with ExpectAllowed field for clearer intent

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
middleware/cors/cors.go	Fixed null origin validation to use case-sensitive comparison with originHeaderRaw instead of lowercased originHeader
middleware/cors/cors_test.go	Added test cases for "NULL", "Null", and wildcard "*" origins, plus ExpectAllowed field for clearer test assertions

The implementation is correct and well-tested. The security fix properly addresses the vulnerability by ensuring only the lowercase literal "null" is accepted as a valid null origin, which aligns with the CORS specification and legitimate browser behavior. No issues were identified in this pull request.