Skip to content

Add wildcard host matching to AllowedHostsValidator #701

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
David Blain (dabla) wants to merge 1 commit into
base: main
Choose a base branch
from
+34 −2
Open

Add wildcard host matching to AllowedHostsValidator #701

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion packages/abstractions/kiota_abstractions/authentication/allowed_hosts_validator.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,4 +67,12 @@ def is_url_host_valid(self, url: str) -> bool:
return False
if not o.hostname:
return False
return o.hostname.lower() in self.allowed_hosts
hostname = o.hostname.lower()
# Existing exact match
if hostname in self.allowed_hosts:
return True
# Suffix match for entries starting with "."
return any(
suffix.startswith(".") and hostname.endswith(suffix)
for suffix in self.allowed_hosts
)
26 changes: 25 additions & 1 deletion packages/abstractions/tests/authentication/test_allowed_hosts_validator.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,28 @@ def test_validates_subdomain_separately(self):
validator = AllowedHostsValidator(["example.com"])
assert validator.is_url_host_valid("https://sub.example.com/path") is False

def test_returns_true_for_subdomain_matching_allowed_suffix(self):
validator = AllowedHostsValidator([".fabric.microsoft.com"])
assert validator.is_url_host_valid(
"https://abc.123.graphql.fabric.microsoft.com/path"
) is True

def test_returns_false_for_bare_domain_when_allowed_as_suffix(self):
validator = AllowedHostsValidator([".fabric.microsoft.com"])
assert validator.is_url_host_valid("https://fabric.microsoft.com/path") is False

def test_suffix_host_matching_is_case_insensitive(self):
validator = AllowedHostsValidator([".Fabric.Microsoft.COM"])
assert validator.is_url_host_valid("https://ABC.z2c.graphql.fabric.microsoft.com/path") is True

def test_allows_multiple_valid_hosts(self):
validator = AllowedHostsValidator(["example.com", "api.example.com"])
validator = AllowedHostsValidator(["example.com", "api.example.com", ".fabric.microsoft.com"])
assert validator.is_url_host_valid("https://example.com/path") is True
assert validator.is_url_host_valid("https://api.example.com/path") is True
assert validator.is_url_host_valid("https://other.com/path") is False
assert validator.is_url_host_valid(
"https://abc.123.graphql.fabric.microsoft.com/path"
) is True

def test_handles_url_with_port(self):
validator = AllowedHostsValidator(["example.com"])
Expand All @@ -93,3 +110,10 @@ def test_raises_on_http_prefix(self):
validator = AllowedHostsValidator(["example.com"])
with pytest.raises(ValueError):
validator.set_allowed_hosts(["http://example.com"])

def test_allows_suffix_based_hosts_after_update(self):
validator = AllowedHostsValidator(["example.com"])
validator.set_allowed_hosts([".fabric.microsoft.com"])
assert validator.is_url_host_valid(
"https://abc.123.graphql.fabric.microsoft.com/path"
) is True
Loading