From ae57df9c44b3be3afe469f9e86b96a623a9d8baf Mon Sep 17 00:00:00 2001
From: Dave D'Amico <ddamico@hashicorp.com>
Date: Thu, 3 Oct 2019 06:48:13 -0400
Subject: [PATCH] Fix to allow whitelist globbing for strings after wildcard
 (#796)

* almost ready for PR

* updated test and fmt

* added one more test per feedback

* updates to testing and code per feedback
---
 server/events/repo_whitelist_checker.go      | 16 ++++++++++-
 server/events/repo_whitelist_checker_test.go | 28 ++++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/server/events/repo_whitelist_checker.go b/server/events/repo_whitelist_checker.go
index 8b7d82ee4..0086cfb84 100644
--- a/server/events/repo_whitelist_checker.go
+++ b/server/events/repo_whitelist_checker.go
@@ -72,7 +72,21 @@ func (r *RepoWhitelistChecker) matchesRule(rule string, candidate string) bool {
 		return false
 	}
 
-	// Finally we can use the wildcard. Substring both so they're comparing before the wildcard. Example:
+	// If wildcard is not the last character, substring both to compare what is after the wildcard.  Example:
+	// candidate: repo-abc
+	// rule: *-abc
+	// substr(candidate): -abc
+	// substr(rule): -abc
+	if wildcardIdx != len(rule)-1 {
+		// If the rule substring after wildcard does not exist in the candidate, then it is not a match.
+		idx := strings.LastIndex(candidate, rule[wildcardIdx+1:])
+		if idx == -1 {
+			return false
+		}
+		return candidate[idx:] == rule[wildcardIdx+1:]
+	}
+
+	// If wildcard is last character, substring both so they're comparing before the wildcard. Example:
 	// candidate: abcd
 	// rule: abc*
 	// substr(candidate): abc
diff --git a/server/events/repo_whitelist_checker_test.go b/server/events/repo_whitelist_checker_test.go
index 4df1e12fe..1c01f8c52 100644
--- a/server/events/repo_whitelist_checker_test.go
+++ b/server/events/repo_whitelist_checker_test.go
@@ -147,6 +147,34 @@ func TestRepoWhitelistChecker_IsWhitelisted(t *testing.T) {
 			"github.com",
 			true,
 		},
+		{
+			"should match if wildcard is not last character",
+			"github.com/owner/*-repo",
+			"owner/prefix-repo",
+			"github.com",
+			true,
+		},
+		{
+			"should match if wildcard is first character within owner name",
+			"github.com/*-owner/repo",
+			"prefix-owner/repo",
+			"github.com",
+			true,
+		},
+		{
+			"should match if wildcard is at beginning",
+			"*-owner/repo",
+			"prefix-owner/repo",
+			"github.com",
+			true,
+		},
+		{
+			"should match with duplicate",
+			"*runatlantis",
+			"runatlantis/runatlantis",
+			"github.com",
+			true,
+		},
 	}
 
 	for _, c := range cases {