isRequestOriginAllowed function returning random (invalid) results when Regex is used

[Tom-Brouwer]

Prerequisites

• I have written a descriptive issue title
• I have searched existing issues to ensure the bug has not already been reported

Fastify version

3.20.2

Plugin version

6.0.2

Node.js version

16.6.2

Operating system

Linux

Operating system version (i.e. 20.04, 11.3, 10)

PopOS 20.04

Description

Every other request, the isRequestOriginAllowed function, will return an invalid result, in case a Regex is used.

The behaviour can be tracked back to this line in the code

The .test function is called, although this function retains state in the regex object. E.g. on first invocation, it will go through the regex until it is matched, and return the result. On second invocation, it will go through the remainder of the regex and reset, returning a wrong result. Then on the third invocation it produces the right result again. This behaviour is also described on the MDN page of the function:

As with exec() (or in combination with it), test() called multiple times on the same global regular expression instance will advance past the previous match.

Steps to Reproduce

Initialize the plugin with a Regex or list of regexes:

fastify.register(require('fastify-cors'), {
    origin: new RegExp('floodtags.com', 'gi'),
    methods: ['OPTIONS', 'GET', 'POST'],
    credentials: true,
    allowedHeaders: ['Authorization'],
  });

Now every other request from e.g. https://www.floodtags.com/ will not get the correct Access-Control-Allow-Origin header

Expected Behavior

The 'isRequestOriginAllowed' should return the same result on every invocation.

This can be achieved by e.g. using the String.match function instead of Regex.test. I can submit a pull-request for this if needed, please let me know!

[mcollina]

Would you like to send a Pull Request to address this issue? Remember to add unit tests.

[Tom-Brouwer]

Would you like to send a Pull Request to address this issue? Remember to add unit tests.

Ok, great! Please review the Pull-request above.