From bdd53ac9720d74f96de195ce62cf53f4f7c1e3a1 Mon Sep 17 00:00:00 2001
From: Andrew Krasichkov <buglloc@yandex.ru>
Date: Tue, 4 Apr 2017 00:07:48 +0300
Subject: [PATCH] [origins] Deny evil.com domain, must resolve issue #1

---
 gixy/plugins/origins.py                            | 5 +++--
 tests/plugins/simply/origins/structure_dot.conf    | 3 +++
 tests/plugins/simply/origins/structure_fp.conf     | 3 +++
 tests/plugins/simply/origins/structure_prefix.conf | 3 +++
 tests/plugins/simply/origins/structure_suffix.conf | 3 +++
 5 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 tests/plugins/simply/origins/structure_dot.conf
 create mode 100644 tests/plugins/simply/origins/structure_fp.conf
 create mode 100644 tests/plugins/simply/origins/structure_prefix.conf
 create mode 100644 tests/plugins/simply/origins/structure_suffix.conf

diff --git a/gixy/plugins/origins.py b/gixy/plugins/origins.py
index 258c453..5bb8ff8 100644
--- a/gixy/plugins/origins.py
+++ b/gixy/plugins/origins.py
@@ -32,7 +32,7 @@ class origins(Plugin):
             domains = '[^/.]*\.[^/]{2,7}'
 
         scheme = 'https{http}'.format(http=('?' if not self.config.get('https_only') else ''))
-        regex = r'^{scheme}://(?:[^/.]*\.){{0,10}}(?:{domains})(?::\d*)?(?:/|\?|$)'.format(
+        regex = r'^{scheme}://(?:[^/.]*\.){{0,10}}(?P<domain>{domains})(?::\d*)?(?:/|\?|$)'.format(
             scheme=scheme,
             domains=domains
         )
@@ -60,7 +60,8 @@ class origins(Plugin):
             elif not value.endswith('/'):
                 value += '.evil.com'
 
-            if not self.valid_re.match(value):
+            valid = self.valid_re.match(value)
+            if not valid or valid.group('domain') == 'evil.com':
                 invalid_referers.add(value)
 
         if invalid_referers:
diff --git a/tests/plugins/simply/origins/structure_dot.conf b/tests/plugins/simply/origins/structure_dot.conf
new file mode 100644
index 0000000..21e9287
--- /dev/null
+++ b/tests/plugins/simply/origins/structure_dot.conf
@@ -0,0 +1,3 @@
+if ($http_referer !~ "^https://example.com/"){
+    add_header X-Frame-Options SAMEORIGIN;
+}
\ No newline at end of file
diff --git a/tests/plugins/simply/origins/structure_fp.conf b/tests/plugins/simply/origins/structure_fp.conf
new file mode 100644
index 0000000..85de00f
--- /dev/null
+++ b/tests/plugins/simply/origins/structure_fp.conf
@@ -0,0 +1,3 @@
+if ($http_referer !~ "^https://example\.com/"){
+    add_header X-Frame-Options SAMEORIGIN;
+}
\ No newline at end of file
diff --git a/tests/plugins/simply/origins/structure_prefix.conf b/tests/plugins/simply/origins/structure_prefix.conf
new file mode 100644
index 0000000..0e8176c
--- /dev/null
+++ b/tests/plugins/simply/origins/structure_prefix.conf
@@ -0,0 +1,3 @@
+if ($http_referer !~ "https://example\.com/"){
+    add_header X-Frame-Options SAMEORIGIN;
+}
\ No newline at end of file
diff --git a/tests/plugins/simply/origins/structure_suffix.conf b/tests/plugins/simply/origins/structure_suffix.conf
new file mode 100644
index 0000000..7a9ed7b
--- /dev/null
+++ b/tests/plugins/simply/origins/structure_suffix.conf
@@ -0,0 +1,3 @@
+if ($http_referer !~ "^https://example\.com"){
+    add_header X-Frame-Options SAMEORIGIN;
+}
\ No newline at end of file