Skip to content

Commit e2ba0d9

Browse files
author
Chuan Ren
authored
[3PI] Validate external account credentials token urls (grpc#26966)
* Validate token urls * Update external_account_credentials.cc * Update external_account_credentials.cc * Remove regex * Validate implicit flow * Update credentials_test.cc * Update google_default_credentials.cc * Revert "Update credentials_test.cc" This reverts commit c43e00d. * Revert "Validate token urls" * Add tests for grpc_google_default_credentials_create * Update google_default_credentials.cc
1 parent d10b2a6 commit e2ba0d9

File tree

2 files changed

+158
-0
lines changed

2 files changed

+158
-0
lines changed

‎src/core/lib/security/credentials/google_default/google_default_credentials.cc

+53
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
#include <string.h>
2424

2525
#include "absl/strings/match.h"
26+
#include "absl/strings/strip.h"
2627

2728
#include <grpc/support/alloc.h>
2829
#include <grpc/support/log.h>
@@ -33,6 +34,7 @@
3334
#include "src/core/lib/channel/channel_args.h"
3435
#include "src/core/lib/gpr/env.h"
3536
#include "src/core/lib/gpr/string.h"
37+
#include "src/core/lib/gprpp/host_port.h"
3638
#include "src/core/lib/gprpp/ref_counted_ptr.h"
3739
#include "src/core/lib/http/httpcli.h"
3840
#include "src/core/lib/http/parser.h"
@@ -221,6 +223,52 @@ static int is_metadata_server_reachable() {
221223
return detector.success;
222224
}
223225

226+
namespace {
227+
228+
bool ValidateUrlField(const Json& json, const std::string& field) {
229+
auto it = json.object_value().find(field);
230+
if (it == json.object_value().end()) {
231+
return true;
232+
}
233+
if (it->second.type() != Json::Type::STRING ||
234+
it->second.string_value().empty()) {
235+
return false;
236+
}
237+
absl::StatusOr<grpc_core::URI> url =
238+
grpc_core::URI::Parse(it->second.string_value());
239+
if (!url.ok()) return false;
240+
if (!absl::EqualsIgnoreCase(url->scheme(), "https")) {
241+
return false;
242+
}
243+
absl::string_view host;
244+
absl::string_view port;
245+
grpc_core::SplitHostPort(url->authority(), &host, &port);
246+
if (absl::ConsumeSuffix(&host, ".googleapis.com")) {
247+
if (host == "sts" || host == "iamcredentials") {
248+
return true;
249+
} else if (absl::StartsWith(host, "sts.") ||
250+
absl::StartsWith(host, "iamcredentials.")) {
251+
return true;
252+
} else if (absl::EndsWith(host, ".sts") ||
253+
absl::EndsWith(host, ".iamcredentials")) {
254+
return true;
255+
} else if (absl::EndsWith(host, "-sts") ||
256+
absl::EndsWith(host, "-iamcredentials")) {
257+
return true;
258+
}
259+
}
260+
return false;
261+
}
262+
263+
bool ValidateExteralAccountCredentials(const Json& json) {
264+
return json.type() == Json::Type::OBJECT &&
265+
ValidateUrlField(json, "token_url") &&
266+
ValidateUrlField(json, "service_account_impersonation_url") &&
267+
ValidateUrlField(json, "token_info_url");
268+
}
269+
270+
} // namespace
271+
224272
/* Takes ownership of creds_path if not NULL. */
225273
static grpc_error_handle create_default_creds_from_path(
226274
const std::string& creds_path,
@@ -274,6 +322,11 @@ static grpc_error_handle create_default_creds_from_path(
274322
}
275323

276324
/* Finally try an external account credentials.*/
325+
if (!ValidateExteralAccountCredentials(json)) {
326+
error = GRPC_ERROR_CREATE_FROM_STATIC_STRING(
327+
"Invalid external account credentials format.");
328+
goto end;
329+
}
277330
result = grpc_core::ExternalAccountCredentials::Create(json, {}, &error);
278331

279332
end:

‎test/core/security/credentials_test.cc

+105
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,43 @@ static const char test_refresh_token_str[] =
108108
" \"refresh_token\": \"1/Blahblasj424jladJDSGNf-u4Sua3HDA2ngjd42\","
109109
" \"type\": \"authorized_user\"}";
110110

111+
/* Test external account credentials. */
112+
static const char test_external_account_credentials_str[] =
113+
"{\"type\":\"external_account\",\"audience\":\"audience\",\"subject_"
114+
"token_type\":\"subject_token_type\",\"service_account_impersonation_"
115+
"url\":\"\",\"token_url\":\"https://"
116+
"sts.googleapis.com:5555/"
117+
"token\",\"token_info_url\":\"\",\"credential_source\":{\"file\":"
118+
"\"credentials_file_path\"},"
119+
"\"quota_project_id\":\"quota_"
120+
"project_id\",\"client_id\":\"client_id\",\"client_secret\":\"client_"
121+
"secret\"}";
122+
123+
static const char test_external_account_credentials_multi_pattern_sts_str[] =
124+
"{\"type\":\"external_account\",\"audience\":\"audience\",\"subject_"
125+
"token_type\":\"subject_token_type\",\"service_account_impersonation_"
126+
"url\":\"https://sts.test.googleapis.com:5555/"
127+
"service_account_impersonation_url\",\"token_url\":\"https://"
128+
"test.sts.googleapis.com:5555/token\",\"token_info_url\":\"https://"
129+
"test-sts.googleapis.com:5555/"
130+
"token_info\",\"credential_source\":{\"file\":\"credentials_file_path\"},"
131+
"\"quota_project_id\":\"quota_"
132+
"project_id\",\"client_id\":\"client_id\",\"client_secret\":\"client_"
133+
"secret\"}";
134+
135+
static const char test_external_account_credentials_multi_pattern_iam_str[] =
136+
"{\"type\":\"external_account\",\"audience\":\"audience\",\"subject_"
137+
"token_type\":\"subject_token_type\",\"service_account_impersonation_"
138+
"url\":\"https://iamcredentials.test.googleapis.com:5555/"
139+
"service_account_impersonation_url\",\"token_url\":\"https://"
140+
"test.iamcredentials.googleapis.com:5555/"
141+
"token\",\"token_info_url\":\"https://"
142+
"test-iamcredentials.googleapis.com:5555/"
143+
"token_info\",\"credential_source\":{\"file\":\"credentials_file_path\"},"
144+
"\"quota_project_id\":\"quota_"
145+
"project_id\",\"client_id\":\"client_id\",\"client_secret\":\"client_"
146+
"secret\"}";
147+
111148
static const char valid_oauth2_json_response[] =
112149
"{\"access_token\":\"ya29.AHES6ZRN3-HlhAPya30GnW_bHSb_\","
113150
" \"expires_in\":3599, "
@@ -1502,6 +1539,71 @@ static void test_google_default_creds_refresh_token(void) {
15021539
gpr_setenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR, ""); /* Reset. */
15031540
}
15041541

1542+
static void test_google_default_creds_external_account_credentials(void) {
1543+
grpc_core::ExecCtx exec_ctx;
1544+
grpc_composite_channel_credentials* creds;
1545+
grpc_flush_cached_google_default_credentials();
1546+
set_google_default_creds_env_var_with_file_contents(
1547+
"google_default_creds_external_account_credentials",
1548+
test_external_account_credentials_str);
1549+
creds = reinterpret_cast<grpc_composite_channel_credentials*>(
1550+
grpc_google_default_credentials_create(nullptr));
1551+
auto* default_creds =
1552+
reinterpret_cast<const grpc_google_default_channel_credentials*>(
1553+
creds->inner_creds());
1554+
GPR_ASSERT(default_creds->ssl_creds() != nullptr);
1555+
auto* external =
1556+
reinterpret_cast<const grpc_core::ExternalAccountCredentials*>(
1557+
creds->call_creds());
1558+
GPR_ASSERT(external != nullptr);
1559+
creds->Unref();
1560+
gpr_setenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR, ""); /* Reset. */
1561+
}
1562+
1563+
static void
1564+
test_google_default_creds_external_account_credentials_multi_pattern_sts(void) {
1565+
grpc_core::ExecCtx exec_ctx;
1566+
grpc_composite_channel_credentials* creds;
1567+
grpc_flush_cached_google_default_credentials();
1568+
set_google_default_creds_env_var_with_file_contents(
1569+
"google_default_creds_external_account_credentials",
1570+
test_external_account_credentials_multi_pattern_sts_str);
1571+
creds = reinterpret_cast<grpc_composite_channel_credentials*>(
1572+
grpc_google_default_credentials_create(nullptr));
1573+
auto* default_creds =
1574+
reinterpret_cast<const grpc_google_default_channel_credentials*>(
1575+
creds->inner_creds());
1576+
GPR_ASSERT(default_creds->ssl_creds() != nullptr);
1577+
auto* external =
1578+
reinterpret_cast<const grpc_core::ExternalAccountCredentials*>(
1579+
creds->call_creds());
1580+
GPR_ASSERT(external != nullptr);
1581+
creds->Unref();
1582+
gpr_setenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR, ""); /* Reset. */
1583+
}
1584+
1585+
static void
1586+
test_google_default_creds_external_account_credentials_multi_pattern_iam(void) {
1587+
grpc_core::ExecCtx exec_ctx;
1588+
grpc_composite_channel_credentials* creds;
1589+
grpc_flush_cached_google_default_credentials();
1590+
set_google_default_creds_env_var_with_file_contents(
1591+
"google_default_creds_external_account_credentials",
1592+
test_external_account_credentials_multi_pattern_iam_str);
1593+
creds = reinterpret_cast<grpc_composite_channel_credentials*>(
1594+
grpc_google_default_credentials_create(nullptr));
1595+
auto* default_creds =
1596+
reinterpret_cast<const grpc_google_default_channel_credentials*>(
1597+
creds->inner_creds());
1598+
GPR_ASSERT(default_creds->ssl_creds() != nullptr);
1599+
auto* external =
1600+
reinterpret_cast<const grpc_core::ExternalAccountCredentials*>(
1601+
creds->call_creds());
1602+
GPR_ASSERT(external != nullptr);
1603+
creds->Unref();
1604+
gpr_setenv(GRPC_GOOGLE_CREDENTIALS_ENV_VAR, ""); /* Reset. */
1605+
}
1606+
15051607
static int default_creds_metadata_server_detection_httpcli_get_success_override(
15061608
const grpc_httpcli_request* request, grpc_millis /*deadline*/,
15071609
grpc_closure* on_done, grpc_httpcli_response* response) {
@@ -3393,6 +3495,9 @@ int main(int argc, char** argv) {
33933495
test_jwt_creds_signing_failure();
33943496
test_google_default_creds_auth_key();
33953497
test_google_default_creds_refresh_token();
3498+
test_google_default_creds_external_account_credentials();
3499+
test_google_default_creds_external_account_credentials_multi_pattern_sts();
3500+
test_google_default_creds_external_account_credentials_multi_pattern_iam();
33963501
test_google_default_creds_gce();
33973502
test_google_default_creds_non_gce();
33983503
test_no_google_default_creds();

0 commit comments

Comments
 (0)