[arpitkjaiswal]

Summary

The CORS classifier reports credentialed origin reflection for header values that browsers reject. For example, Origin: https://evil.example with Access-Control-Allow-Origin: https://Evil.Example and Access-Control-Allow-Credentials: true incorrectly produces a CRITICAL finding. It also accepts True as a credentials value and strips non-HTTP whitespace.

• Compare the allowed origin exactly with the sent origin and require case-sensitive true for credentials.
• Trim only HTTP optional whitespace (space/tab), preserving valid padded values.
• Cover ordinary, null and wildcard origins, invalid credentials values, whitespace, and mocked CLI JSON output/exit status.

Reference: https://fetch.spec.whatwg.org/#cors-check

Scope

Rebased onto upstream main at 16dabf0cea8a43ad9d42733283e0fd8ed74313c0. The PR now contains one commit and only two changed files:

• bughunter/tools/cors_scanner.py — CORS header comparisons; existing executable permission preserved.
• tests/test_cors_scanner.py — regression coverage.

Type

• Bug fix
• False positive reduction

Test Plan

• python -m pytest tests/ -q: 1,160 passed on Python 3.12.14, with dependencies installed from requirements.txt.
• Six CORS regression tests fail against the unmodified current-main classifier (11 pass); all 17 CORS tests pass with the fix.
• git diff --check passes.
• The workflow's command/skill tool-path validation passes.
• CORS regression tests use mocked responses and make no network requests.

GitHub Actions for the updated commit currently reports action_required with no jobs started: https://github.com/awarexone/Agentic-Bug-Hunter/actions/runs/40004391788. Maintainer action is needed before hosted CI can run.

Related Issue

Addresses the requested rebase and CORS-only scope in #171 (comment).

[shuvonsec]

Thanks @arpitkjaiswal. Keeping this open for now — it needs a rebase before it can land. GitHub shows it CONFLICTING against main, and the diff is ~54k additions across 372 files for what the title describes as a CORS header case/whitespace fix. That mismatch means the branch is a long way behind main and is carrying a lot of unrelated changes.

Please:

1. Rebase onto current main and resolve conflicts.
2. Trim the diff down to only the CORS matching logic (and its test) so the actual change is reviewable — right now the real fix is buried.

Once it's rebased and scoped to the CORS change, I'll review and land it.