Cors plugin doesn't validate "flat strings" appropriately

[djdmbrwsk]

Summary

The Cors plugin states you can provide "flat strings or PCRE regexes" for the config.origins value. However, flat string origins are not validated safely.

From what I can tell flat strings are evaluated with re_find() (see here). Since there are no line start/end (^, $) symbols surrounding the flat string, as long as an origin starts with the same characters it will be validated.

Steps To Reproduce

1. Setup an clean Kong environment. I'm using Docker with kong:0.13.0-alpine and postgres:10.1-alpine, but I believe this bug exists in all versions of the plugin (see re_find() link above).
2. Setup the Cors plugin like this:

curl -X POST \
  http://localhost:8001/plugins \
  -H 'Content-Type: application/json' \
  -d '{
    "name": "cors",
    "config": {
      "origins": [
        "http://my-site.com",
        "http://my-other-site.com"
      ]
    }
  }'

3. Ping the Proxy with your legitimate origin and confirm you do get the Access-Control-Allow-Origin response header ✅

curl -X OPTIONS \
  http://localhost:8000 \
  -H 'Origin: http://my-site.com' 

4. Ping the Proxy with a clearly illegitimate origin and confirm you do not get the Access-Control-Allow-Origin response header ✅

curl -X OPTIONS \
  http://localhost:8000 \
  -H 'Origin: http://bad-guys.com' 

5. Ping the Proxy with a tricky illegitimate origin and confirm you do not get the Access-Control-Allow-Origin response header 😞

curl -X OPTIONS \
  http://localhost:8000 \
  -H 'Origin: http://my-site.com.bad-guys.com'