Merged PR 483438: JS SDK - embed URL validation

May Hartov · May Hartov · commit d0af4f368dc9 · 2024-02-11T08:37:22.000Z
Following MSRC case as malicious site can be injected as the embed iframe src, added embed URL validation to ensure the host is an allowed PBI src. A valid embed url protocol is "https:" The valid hosts names are ([retrieved from EV2-deployment repository - all of ida_PowerBIFeUrl key values](https://dev.azure.com/powerbi/PowerBIClients/_search?action=contents&text=ida_PowerBIFeUrl path%3A*envParams*&type=code&lp=code-Project&filters=ProjectFilters{PowerBIClients}RepositoryFilters{PowerBIClients-EV2-Deployment}&pageSize=25&result=DefaultCollection/PowerBIClients/PowerBIClients-EV2-Deployment/GBmaster//WFE/AppService/ADM/Public/INT/envParams.txt)): - app.powerbi.com, - app.powerbi.cn, - app.powerbigov.us, - app.mil.powerbigov.us, - app.high.powerbigov.us, - app.powerbi.eaglex.ic.gov, - app.powerbi.microsoft.scloud, - powerbi-df.analysis-df.windows.net, - CST WFE URLs: 'https://{cst-name}.analysis.windows-int.net' - daily.powerbi.com - dxt.powerbi.com - msit.powerbi.com Embed URL validation should include fabric embed URL. All of the above should be covered by the following regex expressions: .+\.powerbi.com$ - daily.powerbi.com - dxt.powerbi.com - msit.powerbi.com - app.powerbi.com FF: ^app(.mil.|.high.|.)powerbigov.us$ - app.powerbigov.us, - app.mil.powerbigov.us, - app.high.powerbigov.us Edog: .+\.analysis-df.windows.net$ Onebox and CSTs: .+\.analysis.windows-int.net$ Fabric URLs: .+\.fabric.microsoft.com$ **Please look into the test cases in utils.spec.ts to see the valid and invalid embe urls** Related work items: #1245653
diff --git a/dist/powerbi-client.d.ts b/dist/powerbi-client.d.ts
@@ -12,6 +12,7 @@ declare module "config" {
 declare module "errors" {
     export const APINotSupportedForRDLError = "This API is currently not supported for RDL reports";
     export const EmbedUrlNotSupported = "Embed URL is invalid for this scenario. Please use Power BI REST APIs to get the valid URL";
+    export const invalidEmbedUrlErrorMessage: string;
 }
 declare module "util" {
     import { HttpPostMessage } from 'http-post-message';
@@ -124,6 +125,11 @@ declare module "util" {
      * @returns {boolean}
      */
     export function isCreate(embedType: string): boolean;
+    /**
+     * Checks if the embedUrl has an allowed power BI domain
+     * @hidden
+     */
+    export function validateEmbedUrl(embedUrl: string): boolean;
 }
 declare module "embed" {
     import * as models from 'powerbi-models';
@@ -909,7 +915,7 @@ declare module "page" {
          * Get insights for report page
          *
          * ```javascript
-         * page.getSmartNarrativeInsights()
+         * page.getSmartNarrativeInsights();
          * ```
          *
          * @returns {Promise<ISmartNarratives>}
diff --git a/dist/powerbi.js b/dist/powerbi.js
diff --git a/dist/powerbi.min.js b/dist/powerbi.min.js
diff --git a/src/embed.ts b/src/embed.ts
@@ -3,9 +3,9 @@
 
 import * as models from 'powerbi-models';
 import * as sdkConfig from './config';
-import { EmbedUrlNotSupported } from './errors';
+import { EmbedUrlNotSupported, invalidEmbedUrlErrorMessage } from './errors';
 import { ICustomEvent, IEvent, IEventHandler, Service } from './service';
-import { addParamToUrl, assign, autoAuthInEmbedUrl, createRandomString, getTimeDiffInMilliseconds, remove, isCreate } from './util';
+import { addParamToUrl, assign, autoAuthInEmbedUrl, createRandomString, getTimeDiffInMilliseconds, remove, isCreate, validateEmbedUrl } from './util';
 
 declare global {
   interface Document {
@@ -573,7 +573,7 @@ export abstract class Embed {
 
     const accessTokenProvider = eventHooks.accessTokenProvider;
     if (!!accessTokenProvider) {
-      if ((['create', 'quickcreate', 'report'].indexOf(this.embedtype.toLowerCase()) ===  -1) || this.config.tokenType !== models.TokenType.Aad) {
+      if ((['create', 'quickcreate', 'report'].indexOf(this.embedtype.toLowerCase()) === -1) || this.config.tokenType !== models.TokenType.Aad) {
         throw new Error("accessTokenProvider is only supported in report SaaS embed");
       }
     }
@@ -634,10 +634,6 @@ export abstract class Embed {
     // Trim spaces to fix user mistakes.
     hostname = hostname.toLowerCase().trim();
 
-    if (hostname.indexOf("http://") === 0) {
-      throw new Error("HTTP is not allowed. HTTPS is required");
-    }
-
     if (hostname.indexOf("https://") === 0) {
       return `${hostname}/${endpoint}`;
     }
@@ -745,6 +741,9 @@ export abstract class Embed {
     if (!this.iframe) {
       const iframeContent = document.createElement("iframe");
       const embedUrl = this.config.uniqueId ? addParamToUrl(this.config.embedUrl, 'uid', this.config.uniqueId) : this.config.embedUrl;
+      if (!validateEmbedUrl(embedUrl)) {
+        throw new Error(invalidEmbedUrlErrorMessage);
+      }
 
       iframeContent.style.width = '100%';
       iframeContent.style.height = '100%';
diff --git a/src/errors.ts b/src/errors.ts
@@ -3,4 +3,5 @@
 
 export const APINotSupportedForRDLError = "This API is currently not supported for RDL reports";
 export const EmbedUrlNotSupported = "Embed URL is invalid for this scenario. Please use Power BI REST APIs to get the valid URL";
+export const invalidEmbedUrlErrorMessage: string = "Invalid embed URL detected. Either URL hostname or protocol are invalid. Please use Power BI REST APIs to get the valid URL";
 
diff --git a/src/service.ts b/src/service.ts
@@ -29,6 +29,7 @@ import { Visual } from './visual';
 import * as utils from './util';
 import { QuickCreate } from './quickCreate';
 import * as sdkConfig from './config';
+import { invalidEmbedUrlErrorMessage } from './errors';
 
 export interface IEvent<T> {
   type: string;
@@ -667,6 +668,10 @@ export class Service implements IService {
    * @param {HTMLElement} [element=undefined]
    */
   preload(config: IComponentEmbedConfiguration | IEmbedConfigurationBase, element?: HTMLElement): HTMLIFrameElement {
+    if (!utils.validateEmbedUrl(config.embedUrl)) {
+      throw new Error(invalidEmbedUrlErrorMessage);
+    }
+
     const iframeContent = document.createElement("iframe");
     iframeContent.setAttribute("style", "display:none;");
     iframeContent.setAttribute("src", config.embedUrl);
diff --git a/src/util.ts b/src/util.ts
@@ -3,6 +3,22 @@
 
 import { HttpPostMessage } from 'http-post-message';
 
+/**
+ * @hidden
+ */
+const allowedPowerBiHostsRegex =
+  new RegExp(/(.+\.powerbi\.com$)|(.+\.fabric\.microsoft\.com$)|(.+\.analysis\.windows-int\.net$)|(.+\.analysis-df\.windows\.net$)/g);
+
+/**
+ * @hidden
+ */
+const allowedPowerBiHostsSovRegex = new RegExp(/^app\.powerbi\.cn$|^app(\.mil\.|\.high\.|\.)powerbigov\.us$|^app\.powerbi\.eaglex\.ic\.gov$|^app\.powerbi\.microsoft\.scloud$/g);
+
+/**
+ * @hidden
+ */
+const expectedEmbedUrlProtocol: string = "https:";
+
 /**
  * Raises a custom event with event data on the specified HTML element.
  *
@@ -223,3 +239,21 @@ export function getTimeDiffInMilliseconds(start: Date, end: Date): number {
 export function isCreate(embedType: string): boolean {
   return embedType === 'create' || embedType === 'quickcreate';
 }
+
+/**
+ * Checks if the embedUrl has an allowed power BI domain
+ * @hidden
+ */
+export function validateEmbedUrl(embedUrl: string): boolean {
+  if (embedUrl) {
+    let url: URL;
+    try {
+      url = new URL(embedUrl.toLowerCase());
+    } catch(e) {
+      // invalid URL
+      return false;
+    }
+    return url.protocol === expectedEmbedUrlProtocol &&
+      (allowedPowerBiHostsRegex.test(url.hostname) || allowedPowerBiHostsSovRegex.test(url.hostname));
+  }
+}
diff --git a/test/SDK-to-HPM.spec.ts b/test/SDK-to-HPM.spec.ts
@@ -48,9 +48,10 @@ describe('SDK-to-HPM', function () {
     };
 
     spyOn(utils, "getTimeDiffInMilliseconds").and.callFake(() => 700); // Prevent requests from being throttled.
+    spyOn(utils, 'validateEmbedUrl').and.callFake(() => { return true; });
 
     powerbi = new service.Service(spyHpmFactory, noop, spyRouterFactory, { wpmpName: 'SDK-to-HPM report wpmp' });
-
+    
     sdkSessionId = powerbi.getSdkSessionId();
   });
 
diff --git a/test/SDK-to-MockApp.spec.ts b/test/SDK-to-MockApp.spec.ts
@@ -31,6 +31,9 @@ describe('SDK-to-MockApp', function () {
     powerbi = new service.Service(factories.hpmFactory, factories.wpmpFactory, factories.routerFactory, {
       wpmpName: 'SDK-to-MockApp HostWpmp'
     });
+
+    spyOn(utils, 'validateEmbedUrl').and.callFake(() => { return true; });
+
     element = document.createElement('div');
     element.id = "reportContainer1";
     element.className = 'powerbi-report-container2';
diff --git a/test/SDK-to-WPMP.spec.ts b/test/SDK-to-WPMP.spec.ts
@@ -5,6 +5,7 @@ import * as service from '../src/service';
 import * as report from '../src/report';
 import * as Wpmp from 'window-post-message-proxy';
 import * as factories from '../src/factories';
+import * as utils from '../src/util';
 import { spyWpmp } from './utility/mockWpmp';
 import { spyHpm } from './utility/mockHpm';
 import { spyRouter } from './utility/mockRouter';
@@ -17,6 +18,7 @@ describe('SDK-to-WPMP', function () {
   let uniqueId: string;
 
   beforeEach(function () {
+    spyOn(utils, 'validateEmbedUrl').and.callFake(() => { return true; });
     const spyWpmpFactory: factories.IWpmpFactory = (_name?: string, _logMessages?: boolean) => {
       return <Wpmp.WindowPostMessageProxy>spyWpmp;
     };
diff --git a/test/service.spec.ts b/test/service.spec.ts
@@ -6,6 +6,7 @@ import * as embed from '../src/embed';
 import * as report from '../src/report';
 import * as create from '../src/create';
 import * as factories from '../src/factories';
+import * as utils from '../src/util';
 import { EmbedUrlNotSupported } from '../src/errors';
 
 // Todo: remove JQuery usage from this tests file.
@@ -42,6 +43,7 @@ describe('service', function () {
   let element: HTMLDivElement;
 
   beforeEach(function () {
+    spyOn(utils, 'validateEmbedUrl').and.callFake(() => { return true; });
     powerbi = new service.Service(factories.hpmFactory, factories.wpmpFactory, factories.routerFactory);
     powerbi.accessToken = 'ABC123';
     element = document.createElement('div');
diff --git a/test/test.spec.ts b/test/test.spec.ts
@@ -3,6 +3,7 @@
 
 import * as service from '../src/service';
 import * as factories from '../src/factories';
+import * as utils from '../src/util';
 
 // Avoid adding new tests to this file, create another spec file instead.
 
@@ -12,6 +13,7 @@ describe('embed', function () {
   let iframe: HTMLIFrameElement;
 
   beforeEach(function () {
+    spyOn(utils, 'validateEmbedUrl').and.callFake(() => { return true; });
     powerbi = new service.Service(factories.hpmFactory, factories.wpmpFactory, factories.routerFactory);
     powerbi.accessToken = 'ABC123';
     container = document.createElement('iframe');
diff --git a/test/util.spec.ts b/test/util.spec.ts
@@ -0,0 +1,50 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+import { validateEmbedUrl } from '../src/util';
+
+describe('util', function () {
+  const validEmbedHosts: string[] = [
+    "https://app.powerbi.com",
+    "https://dxt.powerbi.com",
+    "https://msit.powerbi.com",
+    "https://daily.powerbi.com",
+    "https://app.powerbi.cn",
+    "https://app.powerbigov.us/",
+    "https://app.powerbigov.us/reportEmbed?someQueryParam=x",
+    "https://msit.fabric.microsoft.com/groups/someGroup/reports/",
+    "HTTPS://APP.powErbi.com",
+    "https://app.mil.powerbigov.us/embed?unmin=1",
+    "https://app.high.powerbigov.us?queryParam",
+    "https://app.powerbi.eaglex.ic.gov//",
+    "https://app.powerbi.microsoft.scloud/dashboardEmbed",
+    "https://app.fabric.microsoft.com/embed?id=123"
+  ];
+  const invalidEmbedHosts: string[] = [
+    // HTTP schema is not allowed
+    "http://app.powerbi.com",
+    // unknown embed hosts
+    "https://dxt.malicious.com",
+    "https://msit.powerbi-malicious.com",
+    "https://msit.powerbi.unknown",
+    "https://msit.powerbi.com.malicious.com",
+    "https://app.malicious.powerbigov.us/embed?unmin=1",
+    "https://app.mil.malicious.powerbigov.us",
+    "any.analysis-dfxwindows.net",
+    "https://dxtpowerbi.com",
+    "https://dxtapowerbi.com",
+    "app.powerbi.microsoft.scloud.evil.com"
+  ];
+
+  it(`validateEmbedUrl, valid embed hosts, should return true`, () => {
+    for (let i = 0; i++; i < validEmbedHosts.length) {
+      expect(validateEmbedUrl(validEmbedHosts[i])).withContext(`validateEmbedUrl for host ${validEmbedHosts[i]} should return true`).toBeTrue();
+    }
+  });
+
+  it(`validateEmbedUrl, invalid embed hosts, should return false`, () => {
+    for (let i = 0; i++; i < invalidEmbedHosts.length) {
+      expect(validateEmbedUrl(invalidEmbedHosts[i])).withContext(`validateEmbedUrl for host ${invalidEmbedHosts[i]} should return false`).toBeFalse();
+    }
+  });
+});

Original file line number	Diff line number	Diff line change
`@@ -3,4 +3,5 @@`
`3`	`3`
`4`	`4`	`export const APINotSupportedForRDLError = "This API is currently not supported for RDL reports";`
`5`	`5`	`export const EmbedUrlNotSupported = "Embed URL is invalid for this scenario. Please use Power BI REST APIs to get the valid URL";`
	`6`	`+export const invalidEmbedUrlErrorMessage: string = "Invalid embed URL detected. Either URL hostname or protocol are invalid. Please use Power BI REST APIs to get the valid URL";`
`6`	`7`