diff --git a/lib/onebox/engine.rb b/lib/onebox/engine.rb
index 8699cdd1dd7..99064c64b37 100644
--- a/lib/onebox/engine.rb
+++ b/lib/onebox/engine.rb
@@ -17,7 +17,8 @@ module Onebox
     end
 
     def self.origins_to_regexes(origins)
-      return /.*/ if origins.include?("*")
+      return [/.*/] if origins.include?("*")
+
       origins.map do |origin|
         escaped_origin = Regexp.escape(origin)
         if origin.start_with?("*.", "https://*.", "http://*.")
diff --git a/spec/lib/onebox/engine_spec.rb b/spec/lib/onebox/engine_spec.rb
index f5c398195d0..e841de03a12 100644
--- a/spec/lib/onebox/engine_spec.rb
+++ b/spec/lib/onebox/engine_spec.rb
@@ -50,6 +50,18 @@ describe Onebox::Engine do
     end
   end
 
+  describe "origins_to_regexes" do
+    it "converts URLs to regexes" do
+      result = Onebox::Engine.origins_to_regexes(["https://example.com", "https://example2.com"])
+      expect(result).to eq([/\Ahttps:\/\/example\.com/i, /\Ahttps:\/\/example2\.com/i])
+    end
+
+    it "treats '*' as a catch-all" do
+      result = Onebox::Engine.origins_to_regexes(["https://example.com", "*", "https://example2.com"])
+      expect(result).to eq([/.*/])
+    end
+  end
+
   describe "handles_content_type?" do
     class OneboxEngineImages
       include Onebox::Engine