From 239ea619c8b8b41fd8c9733c92842a209c5d22a6 Mon Sep 17 00:00:00 2001
From: fortishield <161459699+FortiShield@users.noreply.github.com>
Date: Tue, 11 Aug 2026 02:36:12 +0600
Subject: [PATCH] Potential fix for code scanning alert no. 7: Missing regular
 expression anchor

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Signed-off-by: fortishield <161459699+FortiShield@users.noreply.github.com>
---
 plugins/aws/cloudfront/publicS3Origin.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/aws/cloudfront/publicS3Origin.js b/plugins/aws/cloudfront/publicS3Origin.js
index 30efea69..0d6b659e 100644
--- a/plugins/aws/cloudfront/publicS3Origin.js
+++ b/plugins/aws/cloudfront/publicS3Origin.js
@@ -52,7 +52,7 @@ module.exports = {
             let publicOrigins = [];
             for (var o in distribution.Origins.Items) {
                 var origin = distribution.Origins.Items[o];
-                if (origin.DomainName && origin.DomainName.match(/s3(.*)\.amazonaws\.com/) &&
+                if (origin.DomainName && origin.DomainName.match(/^s3(?:[.-].*)?\.amazonaws\.com$/) &&
                     origin.S3OriginConfig &&
                     (!origin.S3OriginConfig.OriginAccessIdentity ||
                         !origin.S3OriginConfig.OriginAccessIdentity.length) && !origin.OriginAccessControlId) {