fix(cors): resolve regex false negative and add value-based regex coverage

nettacker/modules/vuln/http_cors.yaml

@@ -334,5 +334,5 @@ payloads:
           conditions:
             headers:
               Access-Control-Allow-Origin:
-                regex: "(http|https):\\/\\/evil.com "
+                regex: "^(http|https):\\/\\/evil\\.com$"
                 reverse: false

tests/test_yaml_regexes.py

@@ -18,7 +18,7 @@ def get_yaml_files():
 
 
 def load_yaml(file_path):
-    with open(file_path, "r") as f:
+    with open(file_path, "r", encoding="utf-8") as f:
         return yaml.safe_load(f)
 
 
@@ -28,12 +28,28 @@ def extract_http_regexes(payloads):
         if payload.get("library") != "http":
             continue
         for step in payload.get("steps", []):
-            conditions = step.get("response", {}).get("conditions", {})
-            if "content" in conditions and "regex" in conditions["content"]:
-                regexes.append(conditions["content"]["regex"])
+            response = step.get("response", {})
+            regexes.extend(extract_regex_values(response))
     return regexes
 
 
+def extract_regex_values(response):
+    def _collect(node):
+        regexes = []
+        if isinstance(node, dict):
+            for key, value in node.items():
+                if key == "regex" and isinstance(value, str):
+                    regexes.append(value)
+                else:
+                    regexes.extend(_collect(value))
+        elif isinstance(node, list):
+            for item in node:
+                regexes.extend(_collect(item))
+        return regexes
+
+    return _collect(response.get("conditions", {}))
+
+
 def extract_socket_regexes(file_name, payloads):
     regexes = []
 
@@ -85,3 +101,21 @@ def test_yaml_regexes_valid(yaml_file):
 
     for regex in regexes:
         assert is_valid_regex(regex), f"Invalid regex in {yaml_file}: `{regex}`"
+
+
+def test_http_cors_reflected_origin_regex_matches_expected_origin():
+    data = load_yaml("nettacker/modules/vuln/http_cors.yaml")
+    payloads = data.get("payloads", [])
+
+    origins = ("http://evil.com", "https://evil.com")
+    matching_regexes = []
+
+    for regex in extract_http_regexes(payloads):
+        compiled_regex = re.compile(regex)
+        if all(compiled_regex.fullmatch(origin) for origin in origins):
+            matching_regexes.append(regex)
+
+    assert matching_regexes, (
+        "Expected at least one http_cors regex to fully match both reflected origins: "
+        "`http://evil.com` and `https://evil.com`"
+    )