Security vulnerability with /* wildcard

[vlad-pisanov]

Say I grant access to /data/*:

allow do
  origins '*'
  resource '/data/*'
end

In actuality, this also grants access to /data_private, /database/foo/bar, and essentially any resource whose path starts with /data. ⚠️

This is because the constructed regex makes the slash optional, and effectively behaves like *:

rx = compile('/data/*')    # /^\/data\/?(.*?)$/
rx === '/data'             # true
rx === '/database'         # true
rx === '/database/foo/bar' # true

[luke-zhou]

I can create a PR, if no one creates