fix: validate canonical CORS origins

Authored-By: @architect <architect@fritzlab.net>

scripts/utils.py

@@ -1,5 +1,6 @@
 """Shared utilities for the site-publish action."""
 
+import ipaddress
 import os
 import re
 import shutil
@@ -105,22 +106,47 @@ def _strings(value, label):
 
 
 def _cors_origins(value, label):
-    origins = _strings(value or [], label)
-    if len(origins) != len(set(origins)):
-        raise ConfigError(f"{label} must not contain duplicates")
+    origins = _list(value, label)
+    if any(not isinstance(item, str) or not item for item in origins):
+        raise ConfigError(f"{label} must be a list of non-empty strings")
+    canonical = []
     for origin in origins:
         if origin == "*":
+            canonical.append(origin)
             continue
         parsed = urlparse(origin)
         try:
             port = parsed.port
         except ValueError:
-            port = None
+            raise ConfigError(f"{label} must contain '*' or canonical HTTPS origins") from None
         if parsed.scheme != "https" or not parsed.hostname or parsed.path or parsed.params or (
             parsed.query or parsed.fragment or parsed.username or parsed.password
-            or (":" in parsed.netloc and port is None and not parsed.netloc.endswith("]"))
         ):
-            raise ConfigError(f"{label} must contain '*' or HTTPS origins")
+            raise ConfigError(f"{label} must contain '*' or canonical HTTPS origins")
+        try:
+            address = ipaddress.ip_address(parsed.hostname)
+        except ValueError:
+            try:
+                hostname = parsed.hostname.encode("idna").decode("ascii")
+            except UnicodeError:
+                raise ConfigError(
+                    f"{label} must contain '*' or canonical HTTPS origins"
+                ) from None
+            try:
+                _hostname(hostname, f"{label} hostname")
+            except ConfigError:
+                raise ConfigError(
+                    f"{label} must contain '*' or canonical HTTPS origins"
+                ) from None
+        else:
+            hostname = f"[{address.compressed}]" if address.version == 6 else address.compressed
+        canonical.append(f"https://{hostname}{f':{port}' if port not in (None, 443) else ''}")
+    if len(canonical) != len(set(canonical)):
+        raise ConfigError(f"{label} must not contain duplicate canonical origins")
+    if "*" in canonical and len(canonical) != 1:
+        raise ConfigError(f"{label} wildcard must be the only origin")
+    if origins != canonical:
+        raise ConfigError(f"{label} must contain '*' or canonical HTTPS origins")
     return origins
 
 
@@ -328,7 +354,10 @@ def _artifact(item, index):
         "website_authority": authority,
         "credentials": normalized_credentials,
         "cache_rules": cache_rules,
-        "cors_origins": _cors_origins(item.get("cors_origins"), f"{label}.cors_origins"),
+        "cors_origins": (
+            _cors_origins(item["cors_origins"], f"{label}.cors_origins")
+            if "cors_origins" in item else []
+        ),
     }