diff --git a/internal/ingress/annotations/cors/main.go b/internal/ingress/annotations/cors/main.go index d2f232af14..de5b8c2794 100644 --- a/internal/ingress/annotations/cors/main.go +++ b/internal/ingress/annotations/cors/main.go @@ -121,19 +121,22 @@ func (c cors) Parse(ing *networking.Ingress) (interface{}, error) { config.CorsEnabled = false } + config.CorsAllowOrigin = []string{} unparsedOrigins, err := parser.GetStringAnnotation("cors-allow-origin", ing) if err == nil { - config.CorsAllowOrigin = strings.Split(unparsedOrigins, ",") - for i, origin := range config.CorsAllowOrigin { + origins := strings.Split(unparsedOrigins, ",") + for _, origin := range origins { origin = strings.TrimSpace(origin) if origin == "*" { config.CorsAllowOrigin = []string{"*"} break } + if !corsOriginRegex.MatchString(origin) { klog.Errorf("Error parsing cors-allow-origin parameters. Supplied incorrect origin: %s. Skipping.", origin) - config.CorsAllowOrigin = append(config.CorsAllowOrigin[:i], config.CorsAllowOrigin[i+1:]...) + continue } + config.CorsAllowOrigin = append(config.CorsAllowOrigin, origin) klog.Infof("Current config.corsAllowOrigin %v", config.CorsAllowOrigin) } } else {