From 7a969bb225df778c8c1a96841b73551bc640d19f Mon Sep 17 00:00:00 2001
From: clawbot <35+clawbot@noreply.example.org>
Date: Mon, 28 Sep 2026 19:51:14 +0000
Subject: [PATCH] Test that an origin with a * inside aborts startup (closes
 #61)

Failing cases for access_control_allow_origin set to https://*,
https://*.example.com and https://*example.com. The CORS middleware
reads a * inside an origin as a pattern, so these would let other sites
read responses; each must abort startup naming the key and the value.

Model: opus-5-5
---
 .../config/config_validation_internal_test.go   | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/internal/config/config_validation_internal_test.go b/internal/config/config_validation_internal_test.go
index cb6f9ca..cb8efb2 100644
--- a/internal/config/config_validation_internal_test.go
+++ b/internal/config/config_validation_internal_test.go
@@ -792,6 +792,23 @@ func invalidSizeAndOriginCases() []abortCase {
 				keyAccessControlAllowOrigin, "https://example.com/",
 			},
 		},
+		{
+			name:              "access_control_allow_origin host *",
+			yaml:              signingKeyLine + "access_control_allow_origin: https://*\n",
+			wantErrSubstrings: []string{keyAccessControlAllowOrigin, "https://*"},
+		},
+		{
+			name: "access_control_allow_origin host *.example.com",
+			yaml: signingKeyLine +
+				"access_control_allow_origin: https://*.example.com\n",
+			wantErrSubstrings: []string{keyAccessControlAllowOrigin, "https://*.example.com"},
+		},
+		{
+			name: "access_control_allow_origin host *example.com",
+			yaml: signingKeyLine +
+				"access_control_allow_origin: https://*example.com\n",
+			wantErrSubstrings: []string{keyAccessControlAllowOrigin, "https://*example.com"},
+		},
 		{
 			name:              "access_control_allow_origin empty",
 			yaml:              signingKeyLine + "access_control_allow_origin: \"\"\n",