Bug with access-control-allow-origin not splitting origins properly

Hey people, thanks for the awesome work with testcafe, today I had an issue and started digging into the code, here is what I found:

Looks like the specified way to define the access-control-allow-origin attribute is separating them by comma followed by a space here.

With that being said, seems like castArray from lodash is not the proper function for this use case https://github.com/DevExpress/testcafe-hammerhead/blob/1aba97d0f2d1a973a0786d73b66408446bb284b3/src/request-pipeline/xhr/same-origin-policy.js#L21

When debugging locally, I found that actually what happens is the following:

castArray('localhost:3000, *')
[ 'localhost:3000, *' ]

Instead of

> castArray('localhost:3000, *')
[ 'localhost:3000', '*' ]

It creates a bug when checking if the request origin is included in the array or when checking if it’s wildcardAllowed: https://github.com/DevExpress/testcafe-hammerhead/blob/1aba97d0f2d1a973a0786d73b66408446bb284b3/src/request-pipeline/xhr/same-origin-policy.js#L35 https://github.com/DevExpress/testcafe-hammerhead/blob/1aba97d0f2d1a973a0786d73b66408446bb284b3/src/request-pipeline/xhr/same-origin-policy.js#L22

What do you guys think? Am I missing something here?

[miherlosev]

Hi @Nipher

Yes, it’s a bug. Thank you for the detailed investigation.

[lock[bot]]

This thread has been automatically locked since it is closed and there has not been any recent activity. Please open a new issue for related bugs or feature requests. We recommend you ask TestCafe API, usage and configuration inquiries on StackOverflow.