Security Vulnerability Report: Wails v2 — Origin Validator Bypass via Wildcard Pattern

Vulnerability Details

Root Cause

wildcardPatternToRegex converts a wildcard pattern to a regular expression by escaping special characters and replacing * with .*. The substituted .* has no restriction — it matches any character sequence including dots and additional domain components.

Vulnerable Code

File: v2/internal/frontend/originvalidator/originValidator.go

func (v *OriginValidator) wildcardPatternToRegex(wildcardPattern string) string {
    specialChars := []string{"\\", ".", "+", "?", "^", "$", "{", "}", "(", ")", "|", "[", "]"}

    escaped := wildcardPattern
    for _, specialChar := range specialChars {
        escaped = strings.ReplaceAll(escaped, specialChar, "\\"+specialChar)
    }

    // * becomes .* — matches ANY character sequence, including dots and domain separators
    escaped = strings.ReplaceAll(escaped, "*", ".*")

    return "^" + escaped + "$"
}

The generated regex for https://myapp.com* is:

^https://myapp\.com.*$

This matches any string beginning with https://myapp.com, including:

• https://myapp.community — different TLD
• https://myapp.com.attacker.com — attacker-controlled subdomain
• https://myapp.comXXXXX — any arbitrary suffix

Scope Note

The official comment in options.go gives https://*.myapp.com as the example pattern (subdomain prefix wildcard). This pattern is not affected. The vulnerability only manifests when developers use a trailing wildcard (myapp.com*), which is a natural misuse when intending to permit a domain and all its subpaths or ports.

Fix

PR: https://github.com/wailsapp/wails/pull/5074

Wildcards are now only expanded when they represent a full domain component (immediately after ://, ., or :). A wildcard appended to a partial label (e.g. com*) is stripped, preventing suffix-based bypasses. Comprehensive test suite added.