Can BPN validation be bypassed?

[SebastianOpriel]

Describe the bug

I would like to know if BPN validation can be bypassed if Catena-X portal does not check Connector URLs of onboarded connectors (need to admit, not being too deep into BPN details yet). Thus, how this risk is mitigated currently?

Potential vector

1. You will need a BPN of a connector, which you want to mimic referred to "BPN_OF_INTEREST".
2. Create a connector for URL https://{{BPN_OF_INTEREST}}.yourdomain.com/[...]/OWN_BPN
3. Register connector in CX portal
4. Try to negotiate a contract with a data offering which has BPN validation active

Expected behavior

Not being able to negotiate a contract

Possible Implementation to mitigate risk

use endswith instead of contains