fix(router): harden proxy-table matching

[chimurai]

closes: #160
closes: #629

Summary by CodeRabbit

• Bug Fixes

  • Proxy table matching tightened to require exact host and proper path-prefix rules, preventing accidental substring matches.

• Tests

  • New unit and end-to-end tests added to cover proxy matching edge cases and superstring host scenarios.

• Documentation

  • Changelog updated with the fix entry.

• Chores

  • Added "superstring" to the spell-check allowlist.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d1e21151-5c17-4c2d-b827-099f3c481a48

📥 Commits

Reviewing files that changed from the base of the PR and between f1e8bd1 and 70be3b5.

📒 Files selected for processing (5)

• CHANGELOG.md
• cspell.json
• src/router.ts
• test/e2e/router.spec.ts
• test/unit/router.spec.ts

✅ Files skipped from review due to trivial changes (2)

• cspell.json
• CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (3)

• test/unit/router.spec.ts
• test/e2e/router.spec.ts
• src/router.ts

---

📝 Walkthrough

Walkthrough

This PR hardens proxy-table matching by replacing substring-based host+path checks with explicit host equality and path-prefix semantics; it adds helper parsing, unit and E2E tests for superstring/subset host/path edge cases, and updates changelog and cspell.

Changes

Proxy-table matching security hardening

Layer / File(s)	Summary
Stricter host+path matching in proxy table src/router.ts	getTargetFromProxyTable replaces substring indexOf matching with explicit host equality plus path-prefix checks for host+path keys; path-only keys match by URL prefix. Helpers isHostAndPathKey and splitHostAndPathKey added.
Unit tests for host and path matching edge cases test/unit/router.spec.ts	New unit assertions ensure host-only keys aren't matched as substrings of other hosts, host+path entries don't match when the request host is a superstring or only contains the configured host as a substring, and path keys don't match when appearing only as non-prefix substrings.
E2E tests for crafted superstring host rejection test/e2e/router.spec.ts	Added E2E cases confirming crafted superstring hosts (e.g., evilbeta.localhost:6000, evillocalhost:6000) do not match configured host-only or host+path proxyTable targets.
Changelog and spell-checker configuration CHANGELOG.md, cspell.json	Changelog entry for the fix under ## next. superstring added to cspell.json word allowlist for test hostnames.

🎯 3 (Moderate) | ⏱️ ~20 minutes

🐰 A proxy table once let bad hosts creep through,
With substring tricks that slipped right by the view.
Now stricter matching guards the sacred door,
No evil superstrings shall pass anymore! 🔐

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(router): harden proxy-table matching' directly summarizes the main change: strengthening the proxy-table matching logic in the router to prevent substring-based matching vulnerabilities.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-router

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

npm i https://pkg.pr.new/http-proxy-middleware@1255

commit: 70be3b5

[coveralls]

coverage: 94.915% (+0.1%) from 94.815% — fix-router into master