updates to matchesDomainPattern

Author: kpodosin

Sources/SwiftNetwork/Utilities/IPAddress+CIDR.swift

@@ -92,7 +92,11 @@ func matchesDomainPattern(_ string: String, pattern: String) -> Bool {
         let pn = patNodes[k]
         let hn = hostNodes[j]
         if pn == hn {
-            if k == 0 { return true }  // a fully-consumed pattern is a suffix match
+            // A match at either boundary succeeds: a fully-consumed pattern (k == 0) is a
+            // suffix match, and a fully-consumed host (j == 0) matches even when pattern
+            // segments remain to the left, so "apple.com" matches "www.apple.com" and
+            // "*.apple.com" matches the bare "apple.com".
+            if j == 0 || k == 0 { return true }
             j -= 1
             k -= 1
         } else if pn == "*" {

Tests/SwiftNetworkTests/SwiftNetworkCIDRTests.swift

@@ -45,20 +45,23 @@ final class SwiftNetworkCIDRTests: NetTestCase {
         XCTAssertTrue(matchesDomainPattern("vpn.corp.apple.com", pattern: "apple.com"))
     }
 
-    func testDomainPattern_suffixMatchDoesNotMatchShorterHost() {
-        // pattern longer than host — no match
-        XCTAssertFalse(matchesDomainPattern("apple.com", pattern: "www.apple.com"))
-        XCTAssertFalse(matchesDomainPattern("com", pattern: "apple.com"))
+    func testDomainPattern_hostShorterThanPatternStillMatchesOnSuffix() {
+        // Once the host is fully consumed against the pattern's rightmost segments it
+        // is a match, even if the pattern has extra segments to the left. So a host
+        // shorter than the pattern can still match on its suffix.
+        XCTAssertTrue(matchesDomainPattern("apple.com", pattern: "www.apple.com"))
+        XCTAssertTrue(matchesDomainPattern("com", pattern: "apple.com"))
     }
 
     func testDomainPattern_wildcardOneSegment() {
         XCTAssertTrue(matchesDomainPattern("www.apple.com", pattern: "*.apple.com"))
         XCTAssertTrue(matchesDomainPattern("mail.apple.com", pattern: "*.apple.com"))
     }
 
-    func testDomainPattern_wildcardRequiresAtLeastOneSegment() {
-        // "*.apple.com" requires a segment before apple.com
-        XCTAssertFalse(matchesDomainPattern("apple.com", pattern: "*.apple.com"))
+    func testDomainPattern_wildcardMatchesDomainItself() {
+        // A leading wildcard can match zero segments, so "*.apple.com" also matches
+        // "apple.com" itself (not just its subdomains).
+        XCTAssertTrue(matchesDomainPattern("apple.com", pattern: "*.apple.com"))
     }
 
     func testDomainPattern_wildcardMatchesAnything() {
@@ -81,7 +84,8 @@ final class SwiftNetworkCIDRTests: NetTestCase {
         // ".apple.com" behaves like "*.apple.com"
         XCTAssertTrue(matchesDomainPattern("www.apple.com", pattern: ".apple.com"))
         XCTAssertTrue(matchesDomainPattern("mail.apple.com", pattern: ".apple.com"))
-        XCTAssertFalse(matchesDomainPattern("apple.com", pattern: ".apple.com"))
+        // The wildcard can match zero segments, so "apple.com" itself matches too.
+        XCTAssertTrue(matchesDomainPattern("apple.com", pattern: ".apple.com"))
     }
 
     // MARK: - IPv4Address.matches — CIDR