Skip to content

fix(NODE-7477): OIDC host allowlist fix#4896

Merged
tadjik1 merged 6 commits intov7.1.xfrom
NODE-7477
Mar 23, 2026
Merged

fix(NODE-7477): OIDC host allowlist fix#4896
tadjik1 merged 6 commits intov7.1.xfrom
NODE-7477

Conversation

@PavelSafronov
Copy link
Contributor

@PavelSafronov PavelSafronov commented Mar 17, 2026

Description

Summary of Changes

Notes for Reviewers

What is the motivation for this change?

Release Highlight

Tighten OIDC ALLOWED_HOSTS wildcard matching

The OIDC ALLOWED_HOSTS wildcard handling has been fixed to require full subdomain/path matches for *. and */ entries, preventing partial suffix matches from being incorrectly accepted.

Double check the following

  • Lint is passing (npm run check:lint)
  • Self-review completed using the steps outlined here
  • PR title follows the correct format: type(NODE-xxxx)[!]: description
    • Example: feat(NODE-1234)!: rewriting everything in coffeescript
  • Changes are covered by tests
  • New TODOs have a related JIRA ticket

Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR tightens the OIDC ALLOWED_HOSTS matching logic by preventing “partial” wildcard suffix matches (e.g., test-mongodb.com no longer matches *.mongodb.com), and adds unit tests covering the new matching behavior. It also introduces a new GitHub Actions release workflow for the v7.1.x branch.

Changes:

  • Update hostMatchesWildcards to require boundary-aware wildcard matches for *. (domains) and */ (unix socket paths).
  • Add unit tests to ensure partial suffix matches are rejected for both domain and unix socket patterns.
  • Add a release-7.1 GitHub Actions workflow targeting the v7.1.x branch.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File Description
src/utils.ts Implements stricter wildcard boundary matching for OIDC host allowlist validation.
test/unit/utils.test.ts Adds regression tests for previously-accepted partial wildcard matches.
.github/workflows/release-7.1.yml Adds a release automation workflow for the v7.1.x branch.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

@dariakp dariakp changed the title fix(7477): OIDC host allowlist fix fix(NODE-7477): OIDC host allowlist fix Mar 18, 2026
@PavelSafronov PavelSafronov marked this pull request as ready for review March 19, 2026 21:22
@PavelSafronov PavelSafronov requested a review from a team as a code owner March 19, 2026 21:22
@tadjik1 tadjik1 self-assigned this Mar 20, 2026
@tadjik1 tadjik1 added the Primary Review In Review with primary reviewer, not yet ready for team's eyes label Mar 20, 2026
tadjik1
tadjik1 previously approved these changes Mar 20, 2026
@dariakp dariakp requested a review from nbbeeken March 22, 2026 17:40
@tadjik1 tadjik1 merged commit 237c9ab into v7.1.x Mar 23, 2026
25 of 28 checks passed
@tadjik1 tadjik1 deleted the NODE-7477 branch March 23, 2026 17:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Primary Review In Review with primary reviewer, not yet ready for team's eyes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants