Merge pull request #10 from Reloadly/develop

Security hardening

Author: Arun Patra

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prizemates/http-firewall",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "HTTP Firewall based on Spring Security HttpFirewall",
   "private": false,
   "main": "./lib/index.js",

src/demo/demo.ts

@@ -17,7 +17,7 @@ app.listen(port, () => {
 
 function firewallOptions(): HttpFirewallOptions {
   // Allows traffic from specific hosts only
-  const allowedHostnamesPredicate = Predicate.of<string>((h) => h.endsWith('example.com')).or(
+  const allowedHostnamesPredicate = Predicate.of<string>((h) => h === 'www.example.com').or(
     Predicate.of<string>((h) => h === 'localhost'),
   );
 

src/strict-http-firewall.ts

@@ -273,7 +273,7 @@ class StrictHttpFirewall {
   private readonly allowedHttpMethods: HttpMethod[] = this.createDefaultAllowedHttpMethods();
   private readonly allowedHostnames: Predicate<String> = new Predicate<string>((hostName) => true);
   private readonly ASSIGNED_AND_NOT_ISO_CONTROL_PATTERN: RegExp = new RegExp(
-    `[\p{IsAssigned}&&[^\p{IsControl}]]*`,
+    '[\\p{IsAssigned}&&[^\\p{IsControl}]]*',
     'g',
   );
   private readonly ASSIGNED_AND_NOT_ISO_CONTROL_PREDICATE: Predicate<string> = new Predicate<string>((testName) =>