Skip to content

Fix trusted endpoint validation for token providers - #643

Closed
komal-rani522 wants to merge 1 commit into
Azure:masterfrom
komal-rani522:security/fix-cwe-918
Closed

Fix trusted endpoint validation for token providers#643
komal-rani522 wants to merge 1 commit into
Azure:masterfrom
komal-rani522:security/fix-cwe-918

Conversation

@komal-rani522

Copy link
Copy Markdown
Collaborator

Summary

Fixes trusted-endpoint validation for BasicTokenProvider and
CallbackTokenProvider authentication paths.

Changes

  • Apply endpoint validation independently of token-provider inheritance.
  • Reject untrusted hosts before token use, callback execution, metadata lookup,
    Authorization-header creation, or HTTP requests.
  • Preserve public-cloud, national-cloud, local-address, additional-host, and
    override-policy behavior.
  • Add synchronous and asynchronous regression tests.

Validation

Local tests could not be executed because the development machine cannot
establish the required TLS connections. GitHub Actions should run the test,
formatting, and lint checks on the pull request.

@komal-rani522

Copy link
Copy Markdown
Collaborator Author

komal-rani522 please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

  • (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
  • (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree company="Microsoft"

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes trusted-endpoint validation across token-provider authentication paths.

Changes:

  • Validates endpoints before token use or network activity.
  • Lazily resolves cloud metadata for built-in endpoints.
  • Adds synchronous and asynchronous regression tests.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File Description
client_base.py Applies validation to all AAD token providers.
kusto_trusted_endpoints.py Adds deferred login-endpoint resolution.
test_endpoint_validation.py Tests early rejection and trust policies.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines +82 to +86
lambda: CloudSettings.get_cloud_info_for_cluster(
self._kusto_cluster,
self._aad_helper.token_provider._proxy_dict,
self._session if isinstance(self._session, Session) else None,
).login_endpoint
well_known_kusto_endpoints.validate_trusted_endpoint(
self._kusto_cluster,
endpoint,
)
).login_endpoint,
@komal-rani522 komal-rani522 closed this by deleting the head repository Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants