Empty Origin header bypasses CORS checks

[AAliKKhan]

In cors.ts, isAllowedCorsOrigin and isAllowedRequestOrigin use if (!input) return true. This treats an empty string (from an empty Origin header) the same as undefined (no Origin header), allowing clients that send Origin: with empty value to bypass all CORS validation.

[github-actions]

This issue doesn't fully meet our contributing guidelines.

What needs to be fixed:

• No issue template was used. Bug reports must use the Bug Report template, which requires a structured Description, steps to reproduce, and system information.
• No reproduction steps provided (e.g., how to send a request with an empty Origin: header and observe the bypass).
• No system context provided (OS, version of opencode, etc.).

Please edit this issue to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

This issue has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new issue that follows our issue templates.