Fix CORS Origin reflection with Allow-Credentials (CWE-346) (#6390)

[R-zin]

Summary

Fixes #6390 (CWE-346: Origin Validation Error in CORS middleware).

Problem

1. Origin Reflection with Credentials: When cfg.CONF.api.allow_origin was configured with * (wildcard), CorsMiddleware reflected the incoming request's Origin header as Access-Control-Allow-Origin: <origin> while simultaneously setting Access-Control-Allow-Credentials: true. This CORS misconfiguration allowed arbitrary third-party websites visited by an authenticated user to perform authenticated, credential-bearing requests to the StackStorm API and read responses (tokens, execution results, datastore values, etc.).
2. Hardcoded Development Origins: The middleware unconditionally injected http://127.0.0.1:3000, http://localhost:8080, and http://127.0.0.1:8080 into the allowed origin list on every request, bypassing administrator configurations in production environments.
3. Empty Origins Configuration: If allow_origin was configured empty, list(origins)[0] resulted in an unhandled IndexError.

Solution

1. Secure Origin and Credentials Handling:
   • Only set Access-Control-Allow-Credentials: true when the incoming origin is explicitly listed in origins (and not *).
   • When wildcard * is present in origins, return Access-Control-Allow-Origin: * and omit Access-Control-Allow-Credentials.
   • When an origin is not in origins, fall back to the default origin without granting credentials.
   • When no Origin header is provided, do not grant credentials.
   • Attach Vary: Origin whenever Access-Control-Allow-Origin depends on the request origin (per CORS specifications).
2. Removed Hardcoded Development Origins:
   • Removed implicit addition of 127.0.0.1:3000, localhost:8080, and 127.0.0.1:8080 from CorsMiddleware. Allowed origins are now strictly derived from configuration.
3. Defensive Origin Parsing & Empty List Guard:
   • Defensively trimmed whitespace from configured origin strings.
   • Guarded against empty origin lists to prevent IndexError.
4. Configuration Documentation:
   • Updated allow_origin help text in st2common/st2common/config.py noting that * disables credentials.

---

Testing

1. Automated Unit Tests:
   • Added a dedicated 21-test suite in st2common/tests/unit/test_cors_middleware.py covering:
     • Explicit whitelisted origin with credentials
     • Multiple configured origins
     • Wildcard origin (*) with untrusted origins (evil.com, subdomains, null, file://)
     • Combination of explicit origins and wildcard
     • Subdomain prefix attacks and port/scheme mismatches
     • Removal of hardcoded localhost origins
     • Preflight (OPTIONS) requests
     • All HTTP methods and status codes (200, 201, 204, 400, 401, 403, 404, 500)
     • Downstream custom header preservation
     • Vary header handling
   • Configured st2common/tests/unit/BUILD with uses=[] for service-independent execution.
   • All 21 tests pass:

     PYTHONPATH="st2common" uv run --python 3.11 --with pytest --with mock --with-requirements st2common/requirements.txt pytest --noconftest st2common/tests/unit/test_cors_middleware.py -v

2. Functional Tests:
   • Updated st2api/tests/unit/controllers/v1/test_base.py to assert Access-Control-Allow-Origin: *, absence of credentials on wildcard, and rejection of hardcoded localhost origins.
3. Code Style & Formatting:
   • Flake8 and Black checks pass with 0 errors.

Closes #6390

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}