Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Wails v2 provides BindingsAllowedOrigins to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in wildcardPatternToRegex converts * to .* without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction. An attacker who controls a domain sharing a prefix with the allowed origin (e.g., myapp.community when myapp.com* is configured) can invoke arbitrary bound Go methods, potentially achieving file system access, data exfiltration, or code …