fix: adding one more pattern to relax the regex check for sts and impersonation url endpoints (googleapis#1158)

BigTailWolf · web-flow · commit 75326e397c61 · 2022-10-06T09:52:56.000-07:00
* fix: relax regex for sts and impersonation url with one more pattern

* adding more testcases for invalid url

* chore: update token
diff --git a/google/auth/external_account.py b/google/auth/external_account.py
@@ -443,6 +443,7 @@ def validate_token_url(token_url):
             "^sts\\.googleapis\\.com$",
             "^sts\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$",
             "^[^\\.\\s\\/\\\\]+\\-sts\\.googleapis\\.com$",
+            "^sts\\-[^\\.\\s\\/\\\\]+\\.p\\.googleapis\\.com$",
         ]
 
         if not Credentials.is_valid_url(_TOKEN_URL_PATTERNS, token_url):
@@ -455,6 +456,7 @@ def validate_service_account_impersonation_url(url):
             "^iamcredentials\\.googleapis\\.com$",
             "^iamcredentials\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$",
             "^[^\\.\\s\\/\\\\]+\\-iamcredentials\\.googleapis\\.com$",
+            "^iamcredentials\\-[^\\.\\s\\/\\\\]+\\.p\\.googleapis\\.com$",
         ]
 
         if not Credentials.is_valid_url(
diff --git a/system_tests/secrets.tar.enc b/system_tests/secrets.tar.enc
diff --git a/tests/test_external_account.py b/tests/test_external_account.py
@@ -289,6 +289,7 @@ def test_valid_token_url_shall_pass_validation(self):
             "https://us-east-1-sts.googleapis.com",
             "https://US-WEST-1-sts.googleapis.com",
             "https://us-west-1-sts.googleapis.com/path?query",
+            "https://sts-us-east-1.p.googleapis.com",
         ]
 
         for url in valid_urls:
@@ -316,6 +317,15 @@ def test_invalid_token_url_shall_throw_exceptions(self):
             "https://us- -1.sts.googleapis.com",
             "https://-sts.googleapis.com",
             "https://us-east-1.sts.googleapis.com.evil.com",
+            "https://sts.pgoogleapis.com",
+            "https://p.googleapis.com",
+            "https://sts.p.com",
+            "http://sts.p.googleapis.com",
+            "https://xyz-sts.p.googleapis.com",
+            "https://sts-xyz.123.p.googleapis.com",
+            "https://sts-xyz.p1.googleapis.com",
+            "https://sts-xyz.p.foo.com",
+            "https://sts-xyz.p.foo.googleapis.com",
         ]
 
         for url in invalid_urls:
@@ -335,6 +345,7 @@ def test_valid_service_account_impersonation_url_shall_pass_validation(self):
             "https://us-east-1-iamcredentials.googleapis.com",
             "https://US-WEST-1-iamcredentials.googleapis.com",
             "https://us-west-1-iamcredentials.googleapis.com/path?query",
+            "https://iamcredentials-us-east-1.p.googleapis.com",
         ]
 
         for url in valid_urls:
@@ -362,6 +373,15 @@ def test_invalid_service_account_impersonate_url_shall_throw_exceptions(self):
             "https://us- -1.iamcredentials.googleapis.com",
             "https://-iamcredentials.googleapis.com",
             "https://us-east-1.iamcredentials.googleapis.com.evil.com",
+            "https://iamcredentials.pgoogleapis.com",
+            "https://p.googleapis.com",
+            "https://iamcredentials.p.com",
+            "http://iamcredentials.p.googleapis.com",
+            "https://xyz-iamcredentials.p.googleapis.com",
+            "https://iamcredentials-xyz.123.p.googleapis.com",
+            "https://iamcredentials-xyz.p1.googleapis.com",
+            "https://iamcredentials-xyz.p.foo.com",
+            "https://iamcredentials-xyz.p.foo.googleapis.com",
         ]
 
         for url in invalid_urls:

Original file line number	Diff line number	Diff line change
`@@ -443,6 +443,7 @@ def validate_token_url(token_url):`
`443`	`443`	`"^sts\\.googleapis\\.com$",`
`444`	`444`	`"^sts\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$",`
`445`	`445`	`"^[^\\.\\s\\/\\\\]+\\-sts\\.googleapis\\.com$",`
	`446`	`+ "^sts\\-[^\\.\\s\\/\\\\]+\\.p\\.googleapis\\.com$",`
`446`	`447`	`]`
`447`	`448`
`448`	`449`	`if not Credentials.is_valid_url(_TOKEN_URL_PATTERNS, token_url):`
`@@ -455,6 +456,7 @@ def validate_service_account_impersonation_url(url):`
`455`	`456`	`"^iamcredentials\\.googleapis\\.com$",`
`456`	`457`	`"^iamcredentials\\.[^\\.\\s\\/\\\\]+\\.googleapis\\.com$",`
`457`	`458`	`"^[^\\.\\s\\/\\\\]+\\-iamcredentials\\.googleapis\\.com$",`
	`459`	`+ "^iamcredentials\\-[^\\.\\s\\/\\\\]+\\.p\\.googleapis\\.com$",`
`458`	`460`	`]`
`459`	`461`
`460`	`462`	`if not Credentials.is_valid_url(`