| 86 | } |
| 87 | |
| 88 | static bool origin_matches_host(const char *origin, const char *host, int port) { |
| 89 | /* Two literal loopback forms only — spelled out so the static URL audit |
| 90 | * sees the complete URL each branch can produce. */ |
| 91 | char expected[128]; |
| 92 | int length = strncmp(host, "localhost", 9) == 0 |
| 93 | ? snprintf(expected, sizeof(expected), "http://localhost:%d", port) |
| 94 | : snprintf(expected, sizeof(expected), "http://127.0.0.1:%d", port); |
| 95 | return length > 0 && (size_t)length < sizeof(expected) && strcmp(origin, expected) == 0; |
| 96 | } |
| 97 | |
| 98 | /* Foreign origins are rejected before this runs. Reflect only the exact |
| 99 | * same-server origin; a different localhost port is a different principal. */ |
no outgoing calls
no test coverage detected