Panic if * is used with AllowOrigin::list (#285)

* Handle `*` in `AllowOrigin::list`

* changelog

* just panic

tower-http/CHANGELOG.md

@@ -22,8 +22,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## Fixed
 
 - **trace:** Correctly identify gRPC requests in default `on_response` callback ([#278])
+- **cors:** Panic if a wildcard (`*`) is passed to `AllowOrigin::list`. Use
+  `AllowOrigin::any()` instead ([#285])
 
 [#278]: https://github.com/tower-rs/tower-http/pull/278
+[#285]: https://github.com/tower-rs/tower-http/pull/285
 
 # 0.3.4 (June 06, 2022)
 

tower-http/src/cors/allow_origin.rs

@@ -40,12 +40,22 @@ impl AllowOrigin {
     ///
     /// See [`CorsLayer::allow_origin`] for more details.
     ///
+    /// # Panics
+    ///
+    /// If the iterator contains a wildcard (`*`).
+    ///
     /// [`CorsLayer::allow_origin`]: super::CorsLayer::allow_origin
+    #[allow(clippy::borrow_interior_mutable_const)]
     pub fn list<I>(origins: I) -> Self
     where
         I: IntoIterator<Item = HeaderValue>,
     {
-        Self(OriginInner::List(origins.into_iter().collect()))
+        let origins = origins.into_iter().collect::<Vec<_>>();
+        if origins.iter().any(|o| o == WILDCARD) {
+            panic!("Wildcard origin (`*`) cannot be passed to `AllowOrigin::list`. Use `AllowOrigin::any()` instead");
+        } else {
+            Self(OriginInner::List(origins))
+        }
     }
 
     /// Set the allowed origins from a predicate