feat(fetch): a wildcard covers subdomains and is not a suffix test #665

Merged

coilyco-ops merged 1 commit from feat/a-wildcard-is-not-a-suffix-claude into main

2026-08-13 18:16:10 +00:00

coilyco-ops commented

2026-08-13 18:14:25 +00:00

Member

closes #663

mozilla.com     # the host itself
*.mozilla.com   # subdomains

The separating dot is the whole security property

docs/sirens-echo-fetch.md chose exact matching for a stated reason:

eco-app.coilysiren.me.evil.example is a different host that a suffix check would accept

A wildcard is exactly where that mistake comes back. Matching "."+suffix rather than suffix is the difference:

www.mozilla.com          matches *.mozilla.com
a.b.mozilla.com          matches
notmozilla.com           refused   <- a suffix test accepts this
evilmozilla.com          refused   <- and this
mozilla.com.evil.example refused

Mutation run. Dropping the dot fails TestAWildcardIsNotASuffixTest on notmozilla.com and evilmozilla.com, plus the apex test. The property is proven rather than asserted.

The apex is a separate entry

Your example lists the bare form as covering the domain and the wildcard as covering subdomains, so I took them as two entries and did not have *.mozilla.com match mozilla.com.

That direction is the safe one to get wrong. Widening it later is one line and cannot break an existing allowlist. Narrowing it later would silently revoke access someone is relying on. Say the word if you want the apex included and it is a one-character change.

Two other guarantees

A malformed pattern matches nothing rather than everything. *., *, *.*.mozilla.com and an inner star are all refused — a typo that opens an allowlist is precisely the failure this bound exists to prevent, and it is the shape #618 and #592 kept finding today.

Bare entries are unchanged. No configured allowlist gains reach when this ships, so this cannot widen a deployment by merging.

ward exec gate green.

closes #663 ``` mozilla.com # the host itself *.mozilla.com # subdomains ``` ## The separating dot is the whole security property `docs/sirens-echo-fetch.md` chose exact matching for a stated reason: > `eco-app.coilysiren.me.evil.example` is a different host that a suffix check would accept A wildcard is exactly where that mistake comes back. Matching `"."+suffix` rather than `suffix` is the difference: ``` www.mozilla.com matches *.mozilla.com a.b.mozilla.com matches notmozilla.com refused <- a suffix test accepts this evilmozilla.com refused <- and this mozilla.com.evil.example refused ``` **Mutation run.** Dropping the dot fails `TestAWildcardIsNotASuffixTest` on `notmozilla.com` and `evilmozilla.com`, plus the apex test. The property is proven rather than asserted. ## The apex is a separate entry Your example lists the bare form as covering the domain and the wildcard as covering subdomains, so I took them as two entries and did not have `*.mozilla.com` match `mozilla.com`. **That direction is the safe one to get wrong.** Widening it later is one line and cannot break an existing allowlist. Narrowing it later would silently revoke access someone is relying on. Say the word if you want the apex included and it is a one-character change. ## Two other guarantees **A malformed pattern matches nothing rather than everything.** `*.`, `*`, `*.*.mozilla.com` and an inner star are all refused — a typo that opens an allowlist is precisely the failure this bound exists to prevent, and it is the shape #618 and #592 kept finding today. **Bare entries are unchanged.** No configured allowlist gains reach when this ships, so this cannot widen a deployment by merging. `ward exec gate` green.

coilyco-ops added 1 commit

2026-08-13 18:14:25 +00:00

feat(fetch): a wildcard covers subdomains and is not a suffix test

ci / image-build (pull_request) Successful in 25s

Details

ci / test (pull_request) Successful in 38s

Details

ci / publish-echo-image (pull_request) Has been skipped

Details

ci / publish-observed (pull_request) Has been skipped

Details

81402e8f52

Kai asked for mozilla.com to cover the host and *.mozilla.com to cover
subdomains. That is what this does.

The separating dot is the whole security property. docs/sirens-echo-fetch.md
chose exact matching because a suffix check accepts
eco-app.coilysiren.me.evil.example, and a wildcard is where that mistake would
come back. Matching on "."+suffix rather than suffix means notmozilla.com and
evilmozilla.com are refused, and the mutation that drops the dot fails the two
tests written for it.

The wildcard does not cover the apex. Kai's example lists the bare entry as
covering the domain itself and the wildcard as covering subdomains, so they are
two entries. Widening that later is one line and cannot break an existing list.
Narrowing it later would.

A pattern with a misplaced, missing, or doubled star matches nothing rather
than everything. A typo that opens the allowlist is the failure this bound
exists to prevent.

Bare entries are unchanged, so no configured allowlist widens when this ships.

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-13 18:14:25 +00:00

coilyco-ops merged commit 5bea5aa220 into main

2026-08-13 18:16:10 +00:00

coilyco-ops referenced this pull request from a commit

2026-08-13 18:16:10 +00:00

Merge pull request 'feat(fetch): a wildcard covers subdomains and is not a suffix test' (#665) from feat/a-wildcard-is-not-a-suffix-claude into main

coilyco-ops referenced this pull request

2026-08-18 20:04:14 +00:00

site-work.md tells Dowel its write surface is quire, which is not in its roster and whose train is parked #977