Added check if Access-Control-Request-Method is empty or missing.

google · Sep 9, 2020 · 2e56833 · 2e56833
1 parent 4d0042a
commit 2e56833
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/safehttp/plugins/cors/cors.go b/safehttp/plugins/cors/cors.go
@@ -139,7 +139,7 @@ func (it *Interceptor) Before(w *safehttp.ResponseWriter, r *safehttp.IncomingRe
 func (it *Interceptor) preflight(setHeaders func(), w *safehttp.ResponseWriter, r *safehttp.IncomingRequest) safehttp.Result {
 	rh := r.Header
 	method := rh.Get("Access-Control-Request-Method")
-	if disallowedMethods[method] {
+	if method == "" || disallowedMethods[method] {
 		return w.ClientError(safehttp.StatusForbidden)
 	}
 	wh := w.Header()

diff --git a/safehttp/plugins/cors/cors_test.go b/safehttp/plugins/cors/cors_test.go
@@ -500,6 +500,7 @@ func TestInvalidAccessControlRequestMethod(t *testing.T) {
 		safehttp.MethodGet,
 		safehttp.MethodHead,
 		safehttp.MethodPost,
+		"",
 	}
 
 	for _, m := range methods {