Add wildcard prefix matching to domains #663

New issue

Closed

opened 2026-08-13 18:09:26 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-08-13 18:09:26 +00:00

Owner

#637

so like this

mozilla.com # covers TLD only
*.mozilla.com # covers all subdomains

https://forgejo.coilysiren.me/coilyco-gaming/sirens-echo/issues/637 so like this ``` mozilla.com # covers TLD only *.mozilla.com # covers all subdomains ```

coilysiren referenced this issue

2026-08-13 18:10:35 +00:00

Populate web fetch egress allowlist: wikipedia, github, all coilysiren domains, temporal.io, example.com, plus ~12 general-purpose domains #637

coilyco-ops commented

2026-08-13 18:13:46 +00:00

Member

Claiming — Angie (ENG, claude seat). 20 minutes from this comment, after the one minute race buffer.

Your two lines are the whole spec and I am not going to embellish them:

mozilla.com     covers that host and nothing else
*.mozilla.com   covers every subdomain

The part I will be careful about

This is an allowlist, so the interesting cases are the ones that must not match. A prefix or suffix test written quickly gets all three of these wrong:

evilmozilla.com        must not match *.mozilla.com
mozilla.com.evil.net   must not match either entry
MOZILLA.COM            should match, hosts are case-insensitive

The first two are the reason to write this as a label-boundary check rather than strings.HasSuffix. I will put each of them in the test table so the trap is recorded rather than merely avoided.

One question your spec answers and I want to confirm I read it right

*.mozilla.com covering all subdomains — I am reading that as covering a.b.mozilla.com as well as a.mozilla.com, and as not covering the bare mozilla.com, since you listed that separately as the thing the plain entry covers. So the two lines together are how you write "the site and everything under it", and *. alone does not silently include the apex.

If you meant *.mozilla.com to include the apex too, say so and it is a one-line change plus a row. I am building the reading above because it is what your two lines say side by side, and because the narrower reading is the safer default for an allowlist.

Scope

The fetch host allowlist only. Existing plain entries keep behaving exactly as they do today, so no deployment's current list changes meaning. I will hand Ops the exact wording if any values want updating, and I am not editing deploy.

**Claiming — Angie (ENG, claude seat).** 20 minutes from this comment, after the one minute race buffer. Your two lines are the whole spec and I am not going to embellish them: ``` mozilla.com covers that host and nothing else *.mozilla.com covers every subdomain ``` ## The part I will be careful about This is an allowlist, so the interesting cases are the ones that must **not** match. A prefix or suffix test written quickly gets all three of these wrong: ``` evilmozilla.com must not match *.mozilla.com mozilla.com.evil.net must not match either entry MOZILLA.COM should match, hosts are case-insensitive ``` The first two are the reason to write this as a label-boundary check rather than `strings.HasSuffix`. I will put each of them in the test table so the trap is recorded rather than merely avoided. ## One question your spec answers and I want to confirm I read it right `*.mozilla.com` covering **all subdomains** — I am reading that as covering `a.b.mozilla.com` as well as `a.mozilla.com`, and as **not** covering the bare `mozilla.com`, since you listed that separately as the thing the plain entry covers. So the two lines together are how you write "the site and everything under it", and `*.` alone does not silently include the apex. If you meant `*.mozilla.com` to include the apex too, say so and it is a one-line change plus a row. I am building the reading above because it is what your two lines say side by side, and because the narrower reading is the safer default for an allowlist. ## Scope The fetch host allowlist only. Existing plain entries keep behaving exactly as they do today, so no deployment's current list changes meaning. I will hand Ops the exact wording if any values want updating, and I am not editing deploy.

coilyco-ops referenced this issue from a pull request that will close it,

2026-08-13 18:14:25 +00:00

feat(fetch): a wildcard covers subdomains and is not a suffix test #665

coilyco-ops added the

autonomy

headless

label

2026-08-13 18:15:30 +00:00

coilyco-ops referenced this issue

2026-08-13 18:15:47 +00:00

Populate web fetch egress allowlist: wikipedia, github, all coilysiren domains, temporal.io, example.com, plus ~12 general-purpose domains #637

coilyco-ops closed this issue