GHSA-24qx-w28j-9m6p

Jupyter Server uses `re.match()` to validate the Origin header against the `allow_origin_pat` configuration.

Since `re.match()` only anchors at the start of the string, an attacker who controls a domain like `http://trusted.example.com.evil.com/` passes validation against a pattern intended to match only `trusted.example.com`.

### Impact

<=2.17.0

### Patches

057869a327c46730afede3eab0ca2d2e3e74acea, 49b34392feaa97735b3b777e3baf8f22f2a14ed8

### Workarounds

Wrap your `allow_origin_pat` value with `^` and `$`

### References

https://github.com/jupyter-server/jupyter_server/pull/603 https://docs.python.org/3/library/re.html#re.fullmatch https://docs.python.org/3/library/re.html#re.match