Bug description 1.2.2/1.2.10/1.4.0/1.5.1/1.5.2/1.5.3/1.5.4/1.6.0 - allowOrigins not blocking curl requests from different origins. Security vulnerability scan has detected this. When I curl if a domain match I get it as access-control-allow-origin: https://testthat.com, but if doesn't match I get access-control-allow-origin: *. I am expecting the request to be blocked.
Expected behavior The specified origin unless being set to * should block everything else exclusively.
Steps to reproduce the bug Create a virtual service with CORS allowOrigins set to https://testthat.com, simulate REST API to the service behind it assuming another ORIGIN and the request will return 200.
On 1.6.0 I am using the virtualservice below to whitelist only single domain and with the following curl I am receiving 200 on a different, why isn't it blocked: curl -X OPTIONS 'https://api2.qa.testthat.com/v1/test/something' -H "Origin: https://testthat.com" -v
# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
labels:
app.kubernetes.io/instance: qa-bom
app.kubernetes.io/managed-by: Tiller
app.kubernetes.io/name: service-test
helm.sh/chart: service-test-0.1.0-release-2-7-0-4-227fd9a
name: service-test
namespace: qa
spec:
gateways:
- api-gateway
hosts:
- service-test
- api2.qa.testthat.com
http:
- corsPolicy:
allowHeaders:
- Authorization
- Content-Type
allowMethods:
- POST
- GET
- PUT
- PATCH
- DELETE
allowOrigins:
- exact: https://testthat.com
match:
- gateways:
- api-gateway
method:
regex: GET|OPTIONS
uri:
regex: /v1/test/.*
route:
- destination:
host: service-test
port:
number: 8080
subset: active
weight: 100
Version (include the output of istioctl version --remote
and kubectl version
and helm version
if you used Helm)
./istioctl version --remote
client version: 1.6.0
control plane version: 1.6.0
data plane version: 1.6.0 (57 proxies)
kubectl version
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1", GitCommit:"b7394102d6ef778017f2ca4046abbaa23b88c290", GitTreeState:"clean", BuildDate:"2019-04-08T17:11:31Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.3", GitCommit:"5e53fd6bc17c0dec8434817e69b04a25d8ae0ff0", GitTreeState:"clean", BuildDate:"2019-06-06T01:36:19Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}
helm version
Client: &version.Version{SemVer:"v2.13.0", GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6", GitTreeState:"clean"}
Server: &version.Version{SemVer:"v2.13.0", GitCommit:"79d07943b03aea2b76c12644b4b54733bc5958d6", GitTreeState:"clean"}
cat /etc/*release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.4 LTS"
NAME="Ubuntu"
VERSION="18.04.4 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.4 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic
How was Istio installed? https://istio.io/docs/setup/install/standalone-operator/'
Environment where bug was observed (cloud vendor, OS, etc) On-premise Ubuntu OS
match.uri.prefix: /v1/test/
instead ofmatch.uri.regex
. This part of envoy docs may be of more help envoyproxy.io/docs/envoy/latest/api-v3/type/matcher/v3/…