Fix CVE-2025-59717 allow-list type confusion - #152

Summary

This fixes CVE-2025-59717 by normalizing the allowedClasses and allowedEnvironments options before performing allow-list membership checks.

Both options are intended to behave as allow-lists. However, .includes() has different behavior depending on the value type: arrays perform exact membership checks, while strings perform substring checks.

That means partial values such as in could match admin,info, and pro could match production,test, even though neither value was explicitly allowed.

Changes

• Normalize string allowedClasses values into a single exact allowed value
• Normalize string allowedEnvironments values into a single exact allowed value
• Keep array-based allow-lists unchanged
• Treat unsupported option types as unset
• Add regression coverage to the existing callout and fence environment tests

Testing

Tested locally with:

npm run lint:js
npm test