File Coverage

blib/lib/Mojolicious/Plugin/SecureCORS.pm

Criterion	Covered	Total	%
statement	97	112	86.6
branch	36	54	66.6
condition	5	5	100.0
subroutine	13	15	86.6
pod	1	1	100.0
total	152	187	81.2

package Mojolicious::Plugin::SecureCORS;

use Mojo::Base 'Mojolicious::Plugin';
use Carp;

our $VERSION = 'v2.0.4';

use List::MoreUtils qw( any none );

use constant DEFAULT_MAX_AGE => 1800;


sub register {
    my ($self, $app, $conf) = @_;
    if (!exists $conf->{max_age}) {
        $conf->{max_age} = DEFAULT_MAX_AGE;
    }

    my $root = $app->routes;

    $root->add_shortcut(under_strict_cors => sub {
        my ($r, @args) = @_;
        return $r->under(@args)->to(cb => \&_strict);
    });

    $root->add_shortcut(cors => sub {
        my ($r, @args) = @_;
        return $r->any(@args)
            ->methods('OPTIONS')
            ->requires(
                headers => {
                    'Origin' => qr/\S/ms,
                    'Access-Control-Request-Method' => qr/\S/ms,
                },
            )
            ->to(cb => sub { _preflight($conf, @_) });
    });

    $app->hook(after_render => \&_request);

    return;
}

sub _strict {
    my ($c) = @_;

    if (!defined $c->req->headers->origin) {
        return 1;       # Not a CORS request, pass
    }

    my $r = $c->match->endpoint;
    while ($r) {
        if ($r->to->{'cors.origin'}) {
            return 1;   # Endpoint configured for CORS, pass
        }
        $r = $r->parent;
    }
    # Endpoint not configured for CORS, block
    $c->render(status => 403, text => 'CORS Forbidden');
    return;
}

sub _preflight {
    my ($conf, $c) = @_;

    my $method = $c->req->headers->header('Access-Control-Request-Method');
    my $match;
    # use options defined on this route, if available
    if ($c->match->endpoint->to->{'cors.origin'}) {
        $match = $c->match;
        my $opt_methods = $match->endpoint->to->{'cors.methods'};
        if ($opt_methods) {
            my %good_methods = map {lc $_ => 1} split /,\s*/ms, $opt_methods;
            if (!$good_methods{lc $method}) {
                return $c->render(status => 204, data => q{});      # Endpoint not found, ignore
            }
        }
    }
    # otherwise try to find route for actual request and use it options
    else {
        $match = Mojolicious::Routes::Match->new(root => $c->app->routes);
        $match->find($c, {
            method => $method,
            path => $c->req->url->path,
        });
        if (!$match->endpoint) {
            return $c->render(status => 204, data => q{});      # Endpoint not found, ignore
        }
    }

    my %opt = _get_opt($match->endpoint);

    if (!$opt{origin}) {
        return $c->render(status => 204, data => q{});      # Endpoint not configured for CORS, ignore
    }

    my $h = $c->res->headers;
    $h->append(Vary => 'Origin');

    my $origin = $c->req->headers->origin;
    if (ref $opt{origin} eq 'Regexp') {
        if ($origin !~ /$opt{origin}/ms) {
            return $c->render(status => 204, data => q{});  # Bad Origin:
        }
    } else {
        if (none {$_ eq q{*} || $_ eq $origin} split q{ }, $opt{origin}) {
            return $c->render(status => 204, data => q{});  # Bad Origin:
        }
    }

    my $headers = $c->req->headers->header('Access-Control-Request-Headers');
    my @want_headers = map {lc} split /,\s*/ms, $headers // q{};
    if (ref $opt{headers} eq 'Regexp') {
        if (any {!/$opt{headers}/ms} @want_headers) {
            return $c->render(status => 204, data => q{});  # Bad Access-Control-Request-Headers:
        }
    } else {
        my %good_headers = map {lc $_ => 1} split /,\s*/ms, $opt{headers};
        if (any {!exists $good_headers{$_}} @want_headers) {
            return $c->render(status => 204, data => q{});  # Bad Access-Control-Request-Headers:
        }
    }

    $h->header('Access-Control-Allow-Origin' => $origin);
    $h->header('Access-Control-Allow-Methods' => $method);
    if (defined $headers) {
        $h->header('Access-Control-Allow-Headers' => $headers);
    }
    if ($opt{credentials}) {
        $h->header('Access-Control-Allow-Credentials' => 'true');
    }
    if (defined $conf->{max_age}) {
        $h->header('Access-Control-Max-Age' => $conf->{max_age});
    }
    return $c->render(status => 204, data => q{});
}

sub _request {
    my ($c, $output, $format) = @_;

    my %opt = _get_opt($c->match->endpoint);

    if (!$opt{origin}) {
        return;     # Endpoint not configured for CORS, ignore
    }

    my $h = $c->res->headers;
    $h->append(Vary => 'Origin');

    my $origin = $c->req->headers->origin;
    if (!defined $origin) {
        return;     # Not a CORS
    }

    if (ref $opt{origin} eq 'Regexp') {
        if ($origin !~ /$opt{origin}/ms) {
            return;     # Bad Origin:
        }
    } else {
        if (none {$_ eq q{*} || $_ eq $origin} split q{ }, $opt{origin}) {
            return;     # Bad Origin:
        }
    }

    $h->header('Access-Control-Allow-Origin' => $origin);
    if ($opt{credentials}) {
        $h->header('Access-Control-Allow-Credentials' => 'true');
    }
    if ($opt{expose}) {
        $h->header('Access-Control-Expose-Headers' => $opt{expose});
    }
    return;
}

sub _get_opt {
    my ($r) = @_;
    my %opt;
    while ($r) {
        for my $name (qw( origin credentials expose headers )) {
            if (!exists $opt{$name} && exists $r->to->{"cors.$name"}) {
                $opt{$name} = $r->to->{"cors.$name"};
            }
        }
        $r = $r->parent;
    }
    return %opt;
}


1; # Magic true value required at end of module
__END__