CVE-2018-11537: Auth0 angular-jwt misinterprets allowlist as regex

The vulnerability stems from how the whiteListedDomains array was processed. In the original code, non-RegExp entries were converted to case-insensitive regex patterns (e.g., new RegExp(domain, 'i')). This caused domain strings like 'whitelisted.Example.com' to match 'whitelistedXexample.com' due to the unescaped '.' acting as a regex wildcard. The patch replaced this logic with strict string equality checks for non-RegExp entries, confirming the root cause was in the regex conversion step. The affected code is located in the interceptor's domain validation loop, specifically in the logic handling whiteListedDomains entries.