update

scripts/image.js

@@ -12,6 +12,8 @@ const browserCacheSeconds = Number.parseInt(
   process.env.IMAGE_BROWSER_CACHE_SECONDS || '3600',
   10,
 );
+// Match complete origins, not substrings such as dnftools.com.example.org.
+const allowedImageOrigin = /^https?:\/\/([a-z0-9-]+\.)+dnftools\.com(:[0-9]+)?$/i;
 
 const mimeTypes = {
   '.avif': 'image/avif',
@@ -123,8 +125,25 @@ function sendText(res, statusCode, message) {
 }
 
 const ImageServer = http.createServer(async (req, res) => {
+  // Exporting DOM to an image fetches icons across origins. Reflect only trusted
+  // origins, including on cached (304) and error responses.
+  res.setHeader('Vary', 'Origin');
+  const origin = req.headers.origin;
+  if (origin && allowedImageOrigin.test(origin)) {
+    res.setHeader('Access-Control-Allow-Origin', origin);
+  }
+
+  if (req.method === 'OPTIONS') {
+    res.setHeader('Access-Control-Allow-Methods', 'GET, HEAD, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'If-None-Match, If-Modified-Since');
+    res.setHeader('Access-Control-Max-Age', '86400');
+    res.writeHead(204);
+    res.end();
+    return;
+  }
+
   if (req.method !== 'GET' && req.method !== 'HEAD') {
-    res.setHeader('Allow', 'GET, HEAD');
+    res.setHeader('Allow', 'GET, HEAD, OPTIONS');
     sendText(res, 405, 'Method not allowed');
     return;
   }