Skip to content

XMLHttpRequest: fix a bug where Access-Control-Allow-Origin: * was not handled correctly #1098

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rbri merged 1 commit into from
Mar 12, 2026
+43 −0
Merged

XMLHttpRequest: fix a bug where Access-Control-Allow-Origin: * was not handled correctly #1098

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.htmlunit.javascript.host.xml;

Check warning on line 15 in src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java

View workflow job for this annotation

GitHub Actions / PMD 

[PMD] reported by reviewdog 🐶
Too many static imports may lead to messy code

Raw Output:
{"level":"warning","locations":[{"physicalLocation":{"artifactLocation":{"uri":"file:///home/runner/work/htmlunit/htmlunit/src/main/java/org/htmlunit/javascript/host/xml/XMLHttpRequest.java"},"region":{"endColumn":3,"endLine":1385,"startColumn":1,"startLine":15}}}],"message":{"text":"Too many static imports may lead to messy code"},"ruleId":"TooManyStaticImports","ruleIndex":62}

import static java.nio.charset.StandardCharsets.UTF_8;
import static org.htmlunit.BrowserVersionFeatures.XHR_HANDLE_SYNC_NETWORK_ERRORS;
Expand Down Expand Up @@ -1133,6 +1133,10 @@
if (HttpHeader.ACCESS_CONTROL_ALLOW_HEADERS.equalsIgnoreCase(pair.getName())) {
String value = pair.getValue();
if (value != null) {
if ("*".equals(value)) {
// all headers are allowed
return true;
}
value = org.htmlunit.util.StringUtils.toRootLowerCase(value);
final String[] values = org.htmlunit.util.StringUtils.splitAtComma(value);
for (String part : values) {
Expand Down
39 changes: 39 additions & 0 deletions src/test/java/org/htmlunit/javascript/host/xml/XMLHttpRequestCORSTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -615,6 +615,45 @@ public void preflight_many_header_values() throws Exception {
verifyTitle2(getWebDriver(), getExpectedAlerts());
}

/**
* @throws Exception if the test fails.
*/
@Test
@Alerts({"4", "200"})
public void preflight_wildcard_allow_headers() throws Exception {
expandExpectedAlertsVariables(new URL("http://localhost:" + PORT));

final String html = DOCTYPE_HTML
+ "<html><head>\n"
+ "<script>\n"
+ LOG_TITLE_FUNCTION
+ "var xhr = new XMLHttpRequest();\n"
+ "function test() {\n"
+ " try {\n"
+ " var url = 'http://' + window.location.hostname + ':" + PORT2 + "/preflight2';\n"
+ " xhr.open('GET', url, false);\n"
+ " xhr.setRequestHeader('X-PING', 'ping');\n"
+ " xhr.setRequestHeader('X-PONG', 'pong');\n"
+ " xhr.send();\n"
+ " log(xhr.readyState);\n"
+ " log(xhr.status);\n"
+ " } catch(e) { logEx(e) }\n"
+ "}\n"
+ "</script>\n"
+ "</head>\n"
+ "<body onload='test()'></body></html>";

PreflightServerServlet.ACCESS_CONTROL_ALLOW_ORIGIN_ = "http://localhost:" + PORT;
PreflightServerServlet.ACCESS_CONTROL_ALLOW_METHODS_ = "POST, GET, OPTIONS";
PreflightServerServlet.ACCESS_CONTROL_ALLOW_HEADERS_ = "*";
final Map<String, Class<? extends Servlet>> servlets2 = new HashMap<>();
servlets2.put("/preflight2", PreflightServerServlet.class);
startWebServer2(".", servlets2);

loadPage2(html, new URL(URL_FIRST, "/preflight1"));
verifyTitle2(getWebDriver(), getExpectedAlerts());
}

/**
* @throws Exception if the test fails.
*/
Expand Down
Loading