Enable CORS checks (#2248)

* Introduce CORS CLI flags.

* Fix test.

substrate/core/cli/src/params.rs

@@ -329,6 +329,13 @@ pub struct RunCmd {
 	#[structopt(long = "ws-port", value_name = "PORT")]
 	pub ws_port: Option<u16>,
 
+	/// Specify browser Origins allowed to access the HTTP & WS RPC servers.
+	/// It's a comma-separated list of origins (protocol://domain or special `null` value).
+	/// Value of `all` will disable origin validation.
+	/// Default is to allow localhost and https://polkadot.js.org origin.
+	#[structopt(long = "rpc-cors", value_name = "ORIGINS", parse(try_from_str = "parse_cors"))]
+	pub rpc_cors: Option<Option<Vec<String>>>,
+
 	/// Specify the pruning mode, a number of blocks to keep or 'archive'. Default is 256.
 	#[structopt(long = "pruning", value_name = "PRUNING_MODE")]
 	pub pruning: Option<String>,
@@ -470,6 +477,23 @@ fn parse_telemetry_endpoints(s: &str) -> Result<(String, u8), Box<std::error::Er
 	}
 }
 
+/// Parse cors origins
+fn parse_cors(s: &str) -> Result<Option<Vec<String>>, Box<std::error::Error>> {
+	let mut is_all = false;
+	let mut origins = Vec::new();
+	for part in s.split(',') {
+		match part {
+			"all" | "*" => {
+				is_all = true;
+				break;
+			},
+			other => origins.push(other.to_owned()),
+		}
+	}
+
+	Ok(if is_all { None } else { Some(origins) })
+}
+
 impl_augment_clap!(RunCmd);
 impl_get_log_filter!(RunCmd);