Skip to content

Commit 23cb8ef

Browse files
lsiraclsirac
authored
fix: add validation for the token URL and service account impersonation URL for Workload Identity Federation (#717)
* fix: add validation for the token URL and service account impersonation URL in ExternalAccountCredentials * fix: review comment * fix: add test case
1 parent 68bceba commit 23cb8ef

File tree

6 files changed

+231
-13
lines changed

6 files changed

+231
-13
lines changed

‎oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,11 @@
4848
import java.util.Arrays;
4949
import java.util.Collection;
5050
import java.util.List;
51+
import java.util.Locale;
5152
import java.util.Map;
5253
import java.util.concurrent.Executor;
54+
import java.util.regex.Matcher;
55+
import java.util.regex.Pattern;
5356
import javax.annotation.Nullable;
5457

5558
/**
@@ -179,6 +182,11 @@ protected ExternalAccountCredentials(
179182
this.environmentProvider =
180183
environmentProvider == null ? SystemEnvironmentProvider.getInstance() : environmentProvider;
181184

185+
validateTokenUrl(tokenUrl);
186+
if (serviceAccountImpersonationUrl != null) {
187+
validateServiceAccountImpersonationInfoUrl(serviceAccountImpersonationUrl);
188+
}
189+
182190
this.impersonatedCredentials = initializeImpersonatedCredentials();
183191
}
184192

@@ -420,6 +428,60 @@ EnvironmentProvider getEnvironmentProvider() {
420428
return environmentProvider;
421429
}
422430

431+
static void validateTokenUrl(String tokenUrl) {
432+
List<Pattern> patterns = new ArrayList<>();
433+
patterns.add(Pattern.compile("^[^\\.\\s\\/\\\\]+\\.sts\\.googleapis\\.com$"));
434+
patterns.add(Pattern.compile("^sts\\.googleapis\\.com$"));
435+
patterns.add(Pattern.compile("^sts\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$"));
436+
patterns.add(Pattern.compile("^[^\\.\\s\\/\\\\]+\\-sts\\.googleapis\\.com$"));
437+
438+
if (!isValidUrl(patterns, tokenUrl)) {
439+
throw new IllegalArgumentException("The provided token URL is invalid.");
440+
}
441+
}
442+
443+
static void validateServiceAccountImpersonationInfoUrl(String serviceAccountImpersonationUrl) {
444+
List<Pattern> patterns = new ArrayList<>();
445+
patterns.add(Pattern.compile("^[^\\.\\s\\/\\\\]+\\.iamcredentials\\.googleapis\\.com$"));
446+
patterns.add(Pattern.compile("^iamcredentials\\.googleapis\\.com$"));
447+
patterns.add(Pattern.compile("^iamcredentials\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$"));
448+
patterns.add(Pattern.compile("^[^\\.\\s\\/\\\\]+\\-iamcredentials\\.googleapis\\.com$"));
449+
450+
if (!isValidUrl(patterns, serviceAccountImpersonationUrl)) {
451+
throw new IllegalArgumentException(
452+
"The provided service account impersonation URL is invalid.");
453+
}
454+
}
455+
456+
/**
457+
* Returns true if the provided URL's scheme is HTTPS and the host comforms to at least one of the
458+
* provided patterns.
459+
*/
460+
private static boolean isValidUrl(List<Pattern> patterns, String url) {
461+
URI uri;
462+
463+
try {
464+
uri = URI.create(url);
465+
} catch (Exception e) {
466+
return false;
467+
}
468+
469+
// Scheme must be https and host must not be null.
470+
if (uri.getScheme() == null
471+
|| uri.getHost() == null
472+
|| !"https".equals(uri.getScheme().toLowerCase(Locale.US))) {
473+
return false;
474+
}
475+
476+
for (Pattern pattern : patterns) {
477+
Matcher match = pattern.matcher(uri.getHost().toLowerCase(Locale.US));
478+
if (match.matches()) {
479+
return true;
480+
}
481+
}
482+
return false;
483+
}
484+
423485
/** Base builder for external account credentials. */
424486
public abstract static class Builder extends GoogleCredentials.Builder {
425487

‎oauth2_http/javatests/com/google/auth/oauth2/AwsCredentialsTest.java‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,8 @@
5858
@RunWith(JUnit4.class)
5959
public class AwsCredentialsTest {
6060

61+
private static final String STS_URL = "https://sts.googleapis.com";
62+
6163
private static final String GET_CALLER_IDENTITY_URL =
6264
"https://sts.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15";
6365

@@ -83,7 +85,7 @@ public class AwsCredentialsTest {
8385
.setHttpTransportFactory(OAuth2Utils.HTTP_TRANSPORT_FACTORY)
8486
.setAudience("audience")
8587
.setSubjectTokenType("subjectTokenType")
86-
.setTokenUrl("tokenUrl")
88+
.setTokenUrl(STS_URL)
8789
.setTokenInfoUrl("tokenInfoUrl")
8890
.setCredentialSource(AWS_CREDENTIAL_SOURCE)
8991
.build();
@@ -495,7 +497,8 @@ public void builder() {
495497
.setHttpTransportFactory(OAuth2Utils.HTTP_TRANSPORT_FACTORY)
496498
.setAudience("audience")
497499
.setSubjectTokenType("subjectTokenType")
498-
.setTokenUrl("tokenUrl")
500+
.setTokenUrl(STS_URL)
501+
.setTokenInfoUrl("tokenInfoUrl")
499502
.setCredentialSource(AWS_CREDENTIAL_SOURCE)
500503
.setTokenInfoUrl("tokenInfoUrl")
501504
.setServiceAccountImpersonationUrl(SERVICE_ACCOUNT_IMPERSONATION_URL)
@@ -507,7 +510,7 @@ public void builder() {
507510

508511
assertEquals("audience", credentials.getAudience());
509512
assertEquals("subjectTokenType", credentials.getSubjectTokenType());
510-
assertEquals(credentials.getTokenUrl(), "tokenUrl");
513+
assertEquals(credentials.getTokenUrl(), STS_URL);
511514
assertEquals(credentials.getTokenInfoUrl(), "tokenInfoUrl");
512515
assertEquals(
513516
credentials.getServiceAccountImpersonationUrl(), SERVICE_ACCOUNT_IMPERSONATION_URL);

‎oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountCredentialsTest.java‎

Lines changed: 154 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,12 @@
4444
import java.io.ByteArrayInputStream;
4545
import java.io.IOException;
4646
import java.net.URI;
47+
import java.util.Arrays;
4748
import java.util.Collection;
4849
import java.util.Date;
4950
import java.util.HashMap;
5051
import java.util.List;
52+
import java.util.Locale;
5153
import java.util.Map;
5254
import javax.annotation.Nullable;
5355
import org.junit.Before;
@@ -59,7 +61,7 @@
5961
@RunWith(JUnit4.class)
6062
public class ExternalAccountCredentialsTest {
6163

62-
private static final String STS_URL = "https://www.sts.google.com";
64+
private static final String STS_URL = "https://sts.googleapis.com";
6365

6466
static class MockExternalAccountCredentialsTransportFactory implements HttpTransportFactory {
6567

@@ -176,7 +178,7 @@ public void fromJson_nullJson_throws() {
176178
@Test
177179
public void fromJson_invalidServiceAccountImpersonationUrl_throws() {
178180
GenericJson json = buildJsonIdentityPoolCredential();
179-
json.put("service_account_impersonation_url", "invalid_url");
181+
json.put("service_account_impersonation_url", "https://iamcredentials.googleapis.com");
180182

181183
try {
182184
ExternalAccountCredentials.fromJson(json, OAuth2Utils.HTTP_TRANSPORT_FACTORY);
@@ -199,6 +201,48 @@ public void fromJson_nullTransport_throws() {
199201
}
200202
}
201203

204+
@Test
205+
public void constructor_invalidTokenUrl() {
206+
try {
207+
new TestExternalAccountCredentials(
208+
transportFactory,
209+
"audience",
210+
"subjectTokenType",
211+
"tokenUrl",
212+
new TestCredentialSource(new HashMap<String, Object>()),
213+
STS_URL,
214+
/* serviceAccountImpersonationUrl= */ null,
215+
"quotaProjectId",
216+
/* clientId= */ null,
217+
/* clientSecret= */ null,
218+
/* scopes= */ null);
219+
fail("Should have failed since an invalid token URL was passed.");
220+
} catch (IllegalArgumentException e) {
221+
assertEquals("The provided token URL is invalid.", e.getMessage());
222+
}
223+
}
224+
225+
@Test
226+
public void constructor_invalidServiceAccountImpersonationUrl() {
227+
try {
228+
new TestExternalAccountCredentials(
229+
transportFactory,
230+
"audience",
231+
"subjectTokenType",
232+
"tokenUrl",
233+
new TestCredentialSource(new HashMap<String, Object>()),
234+
/* tokenInfoUrl= */ null,
235+
"serviceAccountImpersonationUrl",
236+
"quotaProjectId",
237+
/* clientId= */ null,
238+
/* clientSecret= */ null,
239+
/* scopes= */ null);
240+
fail("Should have failed since an invalid token URL was passed.");
241+
} catch (IllegalArgumentException e) {
242+
assertEquals("The provided token URL is invalid.", e.getMessage());
243+
}
244+
}
245+
202246
@Test
203247
public void exchangeExternalCredentialForAccessToken() throws IOException {
204248
ExternalAccountCredentials credential =
@@ -267,7 +311,7 @@ public void getRequestMetadata_withQuotaProjectId() throws IOException {
267311
transportFactory,
268312
"audience",
269313
"subjectTokenType",
270-
"tokenUrl",
314+
STS_URL,
271315
new TestCredentialSource(new HashMap<String, Object>()),
272316
"tokenInfoUrl",
273317
/* serviceAccountImpersonationUrl= */ null,
@@ -282,6 +326,113 @@ public void getRequestMetadata_withQuotaProjectId() throws IOException {
282326
assertEquals("quotaProjectId", requestMetadata.get("x-goog-user-project").get(0));
283327
}
284328

329+
@Test
330+
public void validateTokenUrl_validUrls() {
331+
List<String> validUrls =
332+
Arrays.asList(
333+
"https://sts.googleapis.com",
334+
"https://us-east-1.sts.googleapis.com",
335+
"https://US-EAST-1.sts.googleapis.com",
336+
"https://sts.us-east-1.googleapis.com",
337+
"https://sts.US-WEST-1.googleapis.com",
338+
"https://us-east-1-sts.googleapis.com",
339+
"https://US-WEST-1-sts.googleapis.com",
340+
"https://us-west-1-sts.googleapis.com/path?query");
341+
342+
for (String url : validUrls) {
343+
ExternalAccountCredentials.validateTokenUrl(url);
344+
ExternalAccountCredentials.validateTokenUrl(url.toUpperCase(Locale.US));
345+
}
346+
}
347+
348+
@Test
349+
public void validateTokenUrl_invalidUrls() {
350+
List<String> invalidUrls =
351+
Arrays.asList(
352+
"https://iamcredentials.googleapis.com",
353+
"sts.googleapis.com",
354+
"https://",
355+
"http://sts.googleapis.com",
356+
"https://st.s.googleapis.com",
357+
"https://us-eas\\t-1.sts.googleapis.com",
358+
"https:/us-east-1.sts.googleapis.com",
359+
"https://US-WE/ST-1-sts.googleapis.com",
360+
"https://sts-us-east-1.googleapis.com",
361+
"https://sts-US-WEST-1.googleapis.com",
362+
"testhttps://us-east-1.sts.googleapis.com",
363+
"https://us-east-1.sts.googleapis.comevil.com",
364+
"https://us-east-1.us-east-1.sts.googleapis.com",
365+
"https://us-ea.s.t.sts.googleapis.com",
366+
"https://sts.googleapis.comevil.com",
367+
"hhttps://us-east-1.sts.googleapis.com",
368+
"https://us- -1.sts.googleapis.com",
369+
"https://-sts.googleapis.com",
370+
"https://us-east-1.sts.googleapis.com.evil.com");
371+
372+
for (String url : invalidUrls) {
373+
try {
374+
ExternalAccountCredentials.validateTokenUrl(url);
375+
fail("Should have failed since an invalid URL was passed.");
376+
} catch (IllegalArgumentException e) {
377+
assertEquals("The provided token URL is invalid.", e.getMessage());
378+
}
379+
}
380+
}
381+
382+
@Test
383+
public void validateServiceAccountImpersonationUrls_validUrls() {
384+
List<String> validUrls =
385+
Arrays.asList(
386+
"https://iamcredentials.googleapis.com",
387+
"https://us-east-1.iamcredentials.googleapis.com",
388+
"https://US-EAST-1.iamcredentials.googleapis.com",
389+
"https://iamcredentials.us-east-1.googleapis.com",
390+
"https://iamcredentials.US-WEST-1.googleapis.com",
391+
"https://us-east-1-iamcredentials.googleapis.com",
392+
"https://US-WEST-1-iamcredentials.googleapis.com",
393+
"https://us-west-1-iamcredentials.googleapis.com/path?query");
394+
395+
for (String url : validUrls) {
396+
ExternalAccountCredentials.validateServiceAccountImpersonationInfoUrl(url);
397+
ExternalAccountCredentials.validateServiceAccountImpersonationInfoUrl(
398+
url.toUpperCase(Locale.US));
399+
}
400+
}
401+
402+
@Test
403+
public void validateServiceAccountImpersonationUrls_invalidUrls() {
404+
List<String> invalidUrls =
405+
Arrays.asList(
406+
"https://sts.googleapis.com",
407+
"iamcredentials.googleapis.com",
408+
"https://",
409+
"http://iamcredentials.googleapis.com",
410+
"https://iamcre.dentials.googleapis.com",
411+
"https://us-eas\t-1.iamcredentials.googleapis.com",
412+
"https:/us-east-1.iamcredentials.googleapis.com",
413+
"https://US-WE/ST-1-iamcredentials.googleapis.com",
414+
"https://iamcredentials-us-east-1.googleapis.com",
415+
"https://iamcredentials-US-WEST-1.googleapis.com",
416+
"testhttps://us-east-1.iamcredentials.googleapis.com",
417+
"https://us-east-1.iamcredentials.googleapis.comevil.com",
418+
"https://us-east-1.us-east-1.iamcredentials.googleapis.com",
419+
"https://us-ea.s.t.iamcredentials.googleapis.com",
420+
"https://iamcredentials.googleapis.comevil.com",
421+
"hhttps://us-east-1.iamcredentials.googleapis.com",
422+
"https://us- -1.iamcredentials.googleapis.com",
423+
"https://-iamcredentials.googleapis.com",
424+
"https://us-east-1.iamcredentials.googleapis.com.evil.com");
425+
426+
for (String url : invalidUrls) {
427+
try {
428+
ExternalAccountCredentials.validateServiceAccountImpersonationInfoUrl(url);
429+
fail("Should have failed since an invalid URL was passed.");
430+
} catch (IllegalArgumentException e) {
431+
assertEquals("The provided service account impersonation URL is invalid.", e.getMessage());
432+
}
433+
}
434+
}
435+
285436
private GenericJson buildJsonIdentityPoolCredential() {
286437
GenericJson json = new GenericJson();
287438
json.put("audience", "audience");

‎oauth2_http/javatests/com/google/auth/oauth2/ITWorkloadIdentityFederationTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ private GenericJson buildIdentityPoolCredentialConfig() throws IOException {
164164
config.put("type", "external_account");
165165
config.put("audience", OIDC_AUDIENCE);
166166
config.put("subject_token_type", "urn:ietf:params:oauth:token-type:jwt");
167-
config.put("token_url", "https://sts.googleapis.com/v1beta/token");
167+
config.put("token_url", "https://sts.googleapis.com/v1/token");
168168
config.put(
169169
"service_account_impersonation_url",
170170
String.format(
@@ -183,7 +183,7 @@ private GenericJson buildAwsCredentialConfig() {
183183
config.put("type", "external_account");
184184
config.put("audience", AWS_AUDIENCE);
185185
config.put("subject_token_type", "urn:ietf:params:aws:token-type:aws4_request");
186-
config.put("token_url", "https://sts.googleapis.com/v1beta/token");
186+
config.put("token_url", "https://sts.googleapis.com/v1/token");
187187
config.put(
188188
"service_account_impersonation_url",
189189
String.format(

‎oauth2_http/javatests/com/google/auth/oauth2/IdentityPoolCredentialsTest.java‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,8 @@
5959
@RunWith(JUnit4.class)
6060
public class IdentityPoolCredentialsTest {
6161

62+
private static final String STS_URL = "https://sts.googleapis.com";
63+
6264
private static final Map<String, Object> FILE_CREDENTIAL_SOURCE_MAP =
6365
new HashMap<String, Object>() {
6466
{
@@ -75,7 +77,7 @@ public class IdentityPoolCredentialsTest {
7577
.setHttpTransportFactory(OAuth2Utils.HTTP_TRANSPORT_FACTORY)
7678
.setAudience("audience")
7779
.setSubjectTokenType("subjectTokenType")
78-
.setTokenUrl("tokenUrl")
80+
.setTokenUrl(STS_URL)
7981
.setTokenInfoUrl("tokenInfoUrl")
8082
.setCredentialSource(FILE_CREDENTIAL_SOURCE)
8183
.build();
@@ -422,9 +424,9 @@ public void builder() {
422424
.setHttpTransportFactory(OAuth2Utils.HTTP_TRANSPORT_FACTORY)
423425
.setAudience("audience")
424426
.setSubjectTokenType("subjectTokenType")
425-
.setTokenUrl("tokenUrl")
426-
.setCredentialSource(FILE_CREDENTIAL_SOURCE)
427+
.setTokenUrl(STS_URL)
427428
.setTokenInfoUrl("tokenInfoUrl")
429+
.setCredentialSource(FILE_CREDENTIAL_SOURCE)
428430
.setServiceAccountImpersonationUrl(SERVICE_ACCOUNT_IMPERSONATION_URL)
429431
.setQuotaProjectId("quotaProjectId")
430432
.setClientId("clientId")
@@ -434,7 +436,7 @@ public void builder() {
434436

435437
assertEquals("audience", credentials.getAudience());
436438
assertEquals("subjectTokenType", credentials.getSubjectTokenType());
437-
assertEquals(credentials.getTokenUrl(), "tokenUrl");
439+
assertEquals(credentials.getTokenUrl(), STS_URL);
438440
assertEquals(credentials.getTokenInfoUrl(), "tokenInfoUrl");
439441
assertEquals(
440442
credentials.getServiceAccountImpersonationUrl(), SERVICE_ACCOUNT_IMPERSONATION_URL);

‎oauth2_http/javatests/com/google/auth/oauth2/MockExternalAccountCredentialsTransport.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public class MockExternalAccountCredentialsTransport extends MockHttpTransport {
6868
private static final String AWS_CREDENTIALS_URL = "https://www.aws-credentials.com";
6969
private static final String AWS_REGION_URL = "https://www.aws-region.com";
7070
private static final String METADATA_SERVER_URL = "https://www.metadata.google.com";
71-
private static final String STS_URL = "https://www.sts.google.com";
71+
private static final String STS_URL = "https://sts.googleapis.com";
7272

7373
private static final String SUBJECT_TOKEN = "subjectToken";
7474
private static final String TOKEN_TYPE = "Bearer";

0 commit comments

Comments
 (0)