Vulnerable code sample

# This code represents the flawed origin validation logic present in
# Bokeh versions 3.8.1 and below, which led to CVE-2026-21883.
# NOTE: This is a simplified, self-contained representation for demonstration.
# The actual implementation was part of Bokeh's server connection handling.

from urllib.parse import urlparse

def _check_websocket_origin_vulnerable(origin, allowlist):
    """
    Simulates the vulnerable origin check from Bokeh <= 3.8.1.

    The vulnerability lies in using a simple `endswith` check on the hostname.
    An attacker-controlled domain like 'dashboard.corp.attacker.com'
    will incorrectly pass the check for an allowlist entry of 'dashboard.corp',
    because the string 'dashboard.corp.attacker.com' ends with 'dashboard.corp'.

    The correct, non-vulnerable check would ensure that the match occurs at a
    domain boundary (e.g., the character before the match is a '.' or the
    hostname is an exact match).

    Args:
        origin (str): The value of the 'Origin' header from a WebSocket request.
        allowlist (list[str]): A list of allowed hostnames.

    Returns:
        bool: True if the origin is deemed acceptable by the flawed logic, False otherwise.
    """
    try:
        # Parse the full origin URL (e.g., "http://host:port") to get the hostname.
        parsed_origin = urlparse(origin)
        origin_host = parsed_origin.hostname
        if origin_host is None:
            return False
    except (ValueError, TypeError):
        return False

    # The core of the vulnerability.
    # It checks if the requesting origin's hostname *ends with* an entry
    # in the allowlist, without validating domain boundaries.
    for host in allowlist:
        if origin_host.endswith(host):
            # This check is flawed.
            # For `host` = "dashboard.corp":
            #
            # "dashboard.corp" -> True (correct)
            # "sub.dashboard.corp" -> True (correct, if subdomains are desired)
            # "dashboard.corp.attacker.com" -> True (INCORRECT - THE VULNERABILITY)
            #
            # The connection is accepted because the attacker's hostname string
            # ends with a string from the allowlist.
            return True

    return False

# --- Demonstration of the Flaw ---

# A server is configured with an allowlist. It intends to only allow connections
# from 'dashboard.corp' and its legitimate subdomains.
VULNERABLE_ALLOWLIST = ["dashboard.corp"]

# Test Case 1: A legitimate request from the exact allowed domain.
legitimate_origin = "http://dashboard.corp:80"
is_allowed_1 = _check_websocket_origin_vulnerable(legitimate_origin, VULNERABLE_ALLOWLIST)
# Result for legitimate_origin: True (Correctly allowed)

# Test Case 2: An unrelated, non-malicious request from a different domain.
unrelated_origin = "http://some-other-site.com"
is_allowed_2 = _check_websocket_origin_vulnerable(unrelated_origin, VULNERABLE_ALLOWLIST)
# Result for unrelated_origin: False (Correctly blocked)

# Test Case 3: The exploit. A request from an attacker-controlled domain that
# is crafted to pass the flawed `endswith` check.
malicious_crafted_origin = "http://dashboard.corp.attacker.com"
is_allowed_3 = _check_websocket_origin_vulnerable(malicious_crafted_origin, VULNERABLE_ALLOWLIST)
# Result for malicious_crafted_origin: True (INCORRECTLY ALLOWED - THIS IS THE VULNERABILITY)