Merge pull request #29 from dizeee/dash-match-escape

Escape dashes in origin pattern

Author: NickMRamirez

lib/cors.lua

@@ -56,14 +56,14 @@ M.build_pattern = function(pattern)
       pattern = "//" .. pattern
     end
 
+    -- escape dots and dashes in pattern
+    pattern = pattern:gsub("([%.%-])", "%%%1")
+
     -- an asterisk for the port means allow all ports
     if string.find(pattern, "[:]+%*$") ~= nil then
       pattern = pattern:gsub("[:]+%*$", "[:]+[0-9]+")
     end
 
-    -- escape dots in pattern
-    pattern = pattern:gsub("%.", "%%.")
-
     -- append end character
     pattern = pattern .. "$"
     return pattern

tests/cors_tests.lua

@@ -96,6 +96,11 @@ function test_build_pattern_7()
   luaunit.assertEquals(result, "http://test%.com[:]+[0-9]+$")
 end
 
+function test_build_pattern_8()
+  local result = cors.build_pattern("te-st.com")
+  luaunit.assertEquals(result, "//te%-st%.com$")
+end
+
 function test_get_allowed_origin_case_1()
   local result = cors.get_allowed_origin("http://test.com", {"http://test.com"})
   luaunit.assertEquals(result, "http://test.com")
@@ -151,11 +156,15 @@ function test_get_allowed_origin_case_11()
   luaunit.assertEquals(result, "*")
 end
 
-
 function test_get_allowed_origin_case_12()
   local result = cors.get_allowed_origin("http://test.com:8080", {"http://test.com:*"})
   luaunit.assertEquals(result, "http://test.com:8080")
 end
 
+function test_get_allowed_origin_case_13()
+  local result = cors.get_allowed_origin("https://te-st.com", {"te-st.com"})
+  luaunit.assertEquals(result, "https://te-st.com")
+end
+
 -- this line must go at the end
-os.exit(luaunit.LuaUnit.run())
+os.exit(luaunit.LuaUnit.run())