# Wildcard allowlist match grants unintended access

Allowlists or redirect checks using wildcard, glob, or prefix matching instead of exact comparison

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; 2 confirmed bounties: $1,290 and $10,000; latest 2024-05-29. Updated 2026-11-01._

## How it works
An allowlist is meant to answer one question: is this exact value permitted? When the check uses a wildcard, glob, or prefix match instead of an exact comparison, the answer becomes "does this value start with / loosely resemble the allowed one." That widens the set of accepted inputs far beyond what the author intended. The break is an assumption: that a pattern match is equivalent to membership. It is not — patterns accept siblings, suffixes, and normalized variants the author never enumerated.

## Where it shows up
- Permission flags or config that accept path patterns (`--allow-fs-read`, `--allow-fs-write`, file allowlists) [E2](https://bugbountylibrary.com/r/h1%3A2434819.md)
- Redirect/return-URL validation that checks a host or path prefix rather than the full normalized URL [E3](https://bugbountylibrary.com/r/h1%3A165046.md)
- Browser or platform features implementing non-standard glob/pattern matching on top of an allowlist [E1](https://bugbountylibrary.com/r/blog%3Ablog-lbherrera-me-posts-appcache-forgotten-tales.md)
- Any allowlist that also governs redirect targets, not just direct requests [E1](https://bugbountylibrary.com/r/blog%3Ablog-lbherrera-me-posts-appcache-forgotten-tales.md)
- Checks that compare a path segment exactly but ignore `..` normalization [E3](https://bugbountylibrary.com/r/h1%3A165046.md)

## How to review
Find every allowlist and ask: is the comparison exact after canonicalization? The invariant: the accepted set must equal the intended set, with no extra members. Concretely:
- For pattern matching, test wildcard at start, middle, and end; confirm trailing text is rejected, not silently dropped [E2](https://bugbountylibrary.com/r/h1%3A2434819.md)
- Confirm a trailing `*` does not match a path with its last character stripped (off-by-one) [E2](https://bugbountylibrary.com/r/h1%3A2434819.md)
- For URL checks, normalize (`..`, encoding, case) before comparing, and compare the full origin/path, not a prefix [E3](https://bugbountylibrary.com/r/h1%3A165046.md)
- Confirm the allowlist applies only to the intended operation, not to redirect targets or downstream fetches [E1](https://bugbountylibrary.com/r/blog%3Ablog-lbherrera-me-posts-appcache-forgotten-tales.md)

## How finders spotted it
- Tested wildcard patterns in permission flags, noticed a `.pub` suffix was silently ignored, then probed trailing-wildcard behavior to find the off-by-one match [E2](https://bugbountylibrary.com/r/h1%3A2434819.md)
- Reviewed the deployed fix's exact-store-id check and hypothesized path normalization (`/../`) could reach a different store [E3](https://bugbountylibrary.com/r/h1%3A165046.md)
- Prior leak research showed one manifest section could detect redirects; testing the NETWORK section revealed it acts as an allowlist for redirect targets, and reading browser source surfaced non-standard glob matching [E1](https://bugbountylibrary.com/r/blog%3Ablog-lbherrera-me-posts-appcache-forgotten-tales.md)

## Variants seen
- Permission-model path matching that truncates at the first wildcard, discarding trailing text [E2](https://bugbountylibrary.com/r/h1%3A2434819.md)
- Exact-segment check bypassed by `..` path traversal to a sibling, attacker-controlled page [E3](https://bugbountylibrary.com/r/h1%3A165046.md)
- Non-standard glob matching turning an allowlist into a per-character oracle over redirect URLs [E1](https://bugbountylibrary.com/r/blog%3Ablog-lbherrera-me-posts-appcache-forgotten-tales.md)

## Why fixes fail
E3's open-redirect fix whitelisted an exact store-id path segment but ignored normalization, so `/../<attacker_store_id>` still reached attacker content. E1's first fix was bypassed by abusing spec prefix-matching to re-enable the attack.

## Impact and severity
Leaked CSRF tokens and usernames via char-by-char oracle, chained with cache freezing to defeat token rotation [E1](https://bugbountylibrary.com/r/blog%3Ablog-lbherrera-me-posts-appcache-forgotten-tales.md); access to unintended files such as private SSH keys [E2](https://bugbountylibrary.com/r/h1%3A2434819.md); admin theme editor iframe redirected to arbitrary domains [E3](https://bugbountylibrary.com/r/h1%3A165046.md). Impact rose where the allowlist fed a redirect or oracle and where attacker-controlled pages sat on an allowed host [E1](https://bugbountylibrary.com/r/blog%3Ablog-lbherrera-me-posts-appcache-forgotten-tales.md)[E3](https://bugbountylibrary.com/r/h1%3A165046.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-lbherrera-me-posts-appcache-forgotten-tales.md
- E2: https://bugbountylibrary.com/r/h1%3A2434819.md
- E3: https://bugbountylibrary.com/r/h1%3A165046.md