Wildcards in trusted domains

[lc-guy]

eg. *.bandcamp.com
Some websites are kinda annoying when it comes to this. I don't think the security trade-off is that important if it has to be manually entered?

[prez]

Something like this maybe?

def isURITrusted(self, URIToTest):
    def swmatch(a, b):
        zw = a.split('*')
        if len(zw) == 1:
            return b.startswith(a)
        else:
            return b.startswith(zw[0]) and b.endswith(zw[1])

    URIToTest = URIToTest+"/"
    for trustedProtocol in constants.TRUSTABLE_WEB_PROTOCOLS:
        if URIToTest.startswith(trustedProtocol):
            if self._config['onlySwitchToTrustedDomains']:
                if self._config['trustedDomains']:
                    for trustedDomain in self._config['trustedDomains']:
                        trustableURI = ''.join([trustedProtocol, trustedDomain, "/"])
                        if swmatch(trustableURI, URIToTest):
                            return True
                return False
            else:
                return True
    return False

[prez]

If this is something you have interest in merging, I can make a PR.

[Et0h]

@SeiToKaiChou If that works then yes please make a PR. I don't see any reason not to allow users to have wildcard subdomains, but can see why there are uses cases as highlighted by @lc-guy where it would be useful.

[prez]

The question is whether you want to introduce an fnmatch import to support multiple wildcards in a domain, or if it would be better to leave it at this for simplicity's sake.

[Et0h]

The question is whether you want to introduce an fnmatch import to support multiple wildcards in a domain, or if it would be better to leave it at this for simplicity's sake.

My inclination is to keep it simple for now but if someone comes here with a more complicated use case then we can modify it to handle that.