Skip to content

Commit 35495b1

Browse files
aeitzmanaeitzman
authored
fix: Removed url pattern validation for google urls in external account credential configurations (#1150)
* fix: Removed url pattern validation for google urls, added readme change to explain risk. * fix: formatting
1 parent 5bf606b commit 35495b1

3 files changed

Lines changed: 15 additions & 72 deletions

File tree

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -728,6 +728,13 @@ ExternalAccountCredentials credentials =
728728
ExternalAccountCredentials.fromStream(new FileInputStream("/path/to/credentials.json"));
729729
```
730730

731+
##### Security Considerations
732+
Note that this library does not perform any validation on the token_url, token_info_url,
733+
or service_account_impersonation_url fields of the credential configuration.
734+
It is not recommended to use a credential configuration that you did not
735+
generate with the gcloud CLI unless you verify that the URL fields point to a
736+
googleapis.com domain.
737+
731738
### Downscoping with Credential Access Boundaries
732739

733740
[Downscoping with Credential Access Boundaries](https://cloud.google.com/iam/docs/downscoping-short-lived-credentials)

‎oauth2_http/java/com/google/auth/oauth2/ExternalAccountCredentials.java‎

Lines changed: 5 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,6 @@
5454
import java.util.Locale;
5555
import java.util.Map;
5656
import java.util.concurrent.Executor;
57-
import java.util.regex.Matcher;
5857
import java.util.regex.Pattern;
5958
import javax.annotation.Nullable;
6059

@@ -589,37 +588,20 @@ public boolean isWorkforcePoolConfiguration() {
589588
}
590589

591590
static void validateTokenUrl(String tokenUrl) {
592-
List<Pattern> patterns = new ArrayList<>();
593-
patterns.add(Pattern.compile("^[^\\.\\s\\/\\\\]+\\.sts\\.googleapis\\.com$"));
594-
patterns.add(Pattern.compile("^sts\\.googleapis\\.com$"));
595-
patterns.add(Pattern.compile("^sts\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$"));
596-
patterns.add(Pattern.compile("^[^\\.\\s\\/\\\\]+\\-sts\\.googleapis\\.com$"));
597-
patterns.add(Pattern.compile("^sts\\-[^\\.\\s\\/\\\\]+\\.p\\.googleapis\\.com$"));
598-
599-
if (!isValidUrl(patterns, tokenUrl)) {
591+
if (!isValidUrl(tokenUrl)) {
600592
throw new IllegalArgumentException("The provided token URL is invalid.");
601593
}
602594
}
603595

604596
static void validateServiceAccountImpersonationInfoUrl(String serviceAccountImpersonationUrl) {
605-
List<Pattern> patterns = new ArrayList<>();
606-
patterns.add(Pattern.compile("^[^\\.\\s\\/\\\\]+\\.iamcredentials\\.googleapis\\.com$"));
607-
patterns.add(Pattern.compile("^iamcredentials\\.googleapis\\.com$"));
608-
patterns.add(Pattern.compile("^iamcredentials\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$"));
609-
patterns.add(Pattern.compile("^[^\\.\\s\\/\\\\]+\\-iamcredentials\\.googleapis\\.com$"));
610-
patterns.add(Pattern.compile("^iamcredentials-[^\\.\\s\\/\\\\]+\\.p\\.googleapis\\.com$"));
611-
612-
if (!isValidUrl(patterns, serviceAccountImpersonationUrl)) {
597+
if (!isValidUrl(serviceAccountImpersonationUrl)) {
613598
throw new IllegalArgumentException(
614599
"The provided service account impersonation URL is invalid.");
615600
}
616601
}
617602

618-
/**
619-
* Returns true if the provided URL's scheme is HTTPS and the host comforms to at least one of the
620-
* provided patterns.
621-
*/
622-
private static boolean isValidUrl(List<Pattern> patterns, String url) {
603+
/** Returns true if the provided URL's scheme is valid and is HTTPS. */
604+
private static boolean isValidUrl(String url) {
623605
URI uri;
624606

625607
try {
@@ -635,13 +617,7 @@ private static boolean isValidUrl(List<Pattern> patterns, String url) {
635617
return false;
636618
}
637619

638-
for (Pattern pattern : patterns) {
639-
Matcher match = pattern.matcher(uri.getHost().toLowerCase(Locale.US));
640-
if (match.matches()) {
641-
return true;
642-
}
643-
}
644-
return false;
620+
return true;
645621
}
646622

647623
/**

‎oauth2_http/javatests/com/google/auth/oauth2/ExternalAccountCredentialsTest.java‎

Lines changed: 3 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -980,34 +980,14 @@ public void validateTokenUrl_validUrls() {
980980
public void validateTokenUrl_invalidUrls() {
981981
List<String> invalidUrls =
982982
Arrays.asList(
983-
"https://iamcredentials.googleapis.com",
984983
"sts.googleapis.com",
985984
"https://",
986985
"http://sts.googleapis.com",
987-
"https://st.s.googleapis.com",
988986
"https://us-eas\\t-1.sts.googleapis.com",
989987
"https:/us-east-1.sts.googleapis.com",
990-
"https://US-WE/ST-1-sts.googleapis.com",
991-
"https://sts-us-east-1.googleapis.com",
992-
"https://sts-US-WEST-1.googleapis.com",
993988
"testhttps://us-east-1.sts.googleapis.com",
994-
"https://us-east-1.sts.googleapis.comevil.com",
995-
"https://us-east-1.us-east-1.sts.googleapis.com",
996-
"https://us-ea.s.t.sts.googleapis.com",
997-
"https://sts.googleapis.comevil.com",
998989
"hhttps://us-east-1.sts.googleapis.com",
999-
"https://us- -1.sts.googleapis.com",
1000-
"https://-sts.googleapis.com",
1001-
"https://us-east-1.sts.googleapis.com.evil.com",
1002-
"https://sts.pgoogleapis.com",
1003-
"https://p.googleapis.com",
1004-
"https://sts.p.com",
1005-
"http://sts.p.googleapis.com",
1006-
"https://xyz-sts.p.googleapis.com",
1007-
"https://sts-xyz.123.p.googleapis.com",
1008-
"https://sts-xyz.p1.googleapis.com",
1009-
"https://sts-xyz.p.foo.com",
1010-
"https://sts-xyz.p.foo.googleapis.com");
990+
"https://us- -1.sts.googleapis.com");
1011991

1012992
for (String url : invalidUrls) {
1013993
try {
@@ -1046,34 +1026,14 @@ public void validateServiceAccountImpersonationUrls_validUrls() {
10461026
public void validateServiceAccountImpersonationUrls_invalidUrls() {
10471027
List<String> invalidUrls =
10481028
Arrays.asList(
1049-
"https://sts.googleapis.com",
10501029
"iamcredentials.googleapis.com",
10511030
"https://",
10521031
"http://iamcredentials.googleapis.com",
1053-
"https://iamcre.dentials.googleapis.com",
1032+
"https:/iamcredentials.googleapis.com",
10541033
"https://us-eas\t-1.iamcredentials.googleapis.com",
1055-
"https:/us-east-1.iamcredentials.googleapis.com",
1056-
"https://US-WE/ST-1-iamcredentials.googleapis.com",
1057-
"https://iamcredentials-us-east-1.googleapis.com",
1058-
"https://iamcredentials-US-WEST-1.googleapis.com",
10591034
"testhttps://us-east-1.iamcredentials.googleapis.com",
1060-
"https://us-east-1.iamcredentials.googleapis.comevil.com",
1061-
"https://us-east-1.us-east-1.iamcredentials.googleapis.com",
1062-
"https://us-ea.s.t.iamcredentials.googleapis.com",
1063-
"https://iamcredentials.googleapis.comevil.com",
10641035
"hhttps://us-east-1.iamcredentials.googleapis.com",
1065-
"https://us- -1.iamcredentials.googleapis.com",
1066-
"https://-iamcredentials.googleapis.com",
1067-
"https://us-east-1.iamcredentials.googleapis.com.evil.com",
1068-
"https://iamcredentials.pgoogleapis.com",
1069-
"https://p.googleapis.com",
1070-
"https://iamcredentials.p.com",
1071-
"http://iamcredentials.p.googleapis.com",
1072-
"https://xyz-iamcredentials.p.googleapis.com",
1073-
"https://iamcredentials-xyz.123.p.googleapis.com",
1074-
"https://iamcredentials-xyz.p1.googleapis.com",
1075-
"https://iamcredentials-xyz.p.foo.com",
1076-
"https://iamcredentials-xyz.p.foo.googleapis.com");
1036+
"https://us- -1.iamcredentials.googleapis.com");
10771037

10781038
for (String url : invalidUrls) {
10791039
try {

0 commit comments

Comments
 (0)