Description
When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips validation, but forwards the original request path, which may be served by a different handler without the intended security protections.
Problem types
CWE-284: Improper Access Control
Product status
1.25.0 (semver) before 1.25.1
References
groups.google.com/...g-announce/c/PtW9VW21NPs/m/DJhMQ-m5AQAJ
