[Hardik K (hardikkaurani)]

Description

This PR strengthens host validation and normalization in AllowedHostsValidator:

1. Host normalization & prefix validation:

   • AllowedHostsValidator.__init__ now delegates to set_allowed_hosts to maintain a single normalization path.
   • Trims leading and trailing whitespace from host entries (host.strip()) before storing and checking prefixes.
   • Performs case-insensitive checks for http:// and https:// prefixes (e.g., catching HTTP://... or http://...), raising ValueError consistently.
   • Enforces element type validation (isinstance(host, str)), raising TypeError if a non-string entry is provided.

2. URL validation & security hardening:

   • Strips leading and trailing whitespace from the candidate URL before parsing.
   • Rejects URLs containing userinfo (o.username or o.password) outright to prevent host spoofing and credential leakage (aligning with the TypeScript implementation).
   • Validates URL structure (scheme, netloc, and hostname) before considering allowed_hosts empty fallback, ensuring malformed URLs are rejected even when allowed hosts are not configured.

3. Test coverage:

   • Added unit tests covering whitespace trimming, uppercase/padded prefix rejection, non-string element rejection, userinfo rejection, and malformed URL handling.

cc Vincent Biret (@baywet)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Hardik K (hardikkaurani)]

Hi Vincent Biret (@baywet), opened this PR to normalize allowed hosts, reject URLs with userinfo, and validate URL structure. Unit tests and SonarCloud analysis are all passing. Whenever you have time, please review. Thank you!

[Copilot]

🟡 Changes recommended

Blank-only allowlists can disable credential destination filtering, and URL rejection edge cases and incompatible Azure tests remain unresolved.

4 open issues

• Reject blank allowlist entries to prevent unrestricted credential sends · New
• Handle malformed URLs without raising during host validation · New
• Reject URLs with empty userinfo fields · New
• Update Azure provider tests for rejected URLs and userinfo · New

_{Review effort: Balanced}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Hardik K (hardikkaurani)]

Hi Vincent Biret (@baywet),

Thanks for the review. I've pushed commit [12a6da5](https://github.com/microsoft/kiota-python/commit/12a6da5) addressing the reported feedback.

Changes

• Backing field initialization: Removed the redundant self.allowed_hosts = set() initialization and relied on self.set_allowed_hosts(allowed_hosts) for initialization.
• Blank allowlist entries: Empty or whitespace-only host entries now raise ValueError instead of being silently discarded. Only an explicitly empty list ([]) enables the unrestricted destination fallback.
• Malformed URLs: Added a try...except ValueError guard around URL parsing so malformed URLs, including unmatched IPv6 brackets, are rejected safely.
• Userinfo validation: Updated validation to reject URLs containing userinfo, including empty username or password fields, by checking whether o.username or o.password is not None.
• Azure provider regression tests: Updated test_azure_identity_access_token_provider.py to verify that rejected destinations return an empty token without invoking credentials, while preserving separate coverage for scope derivation from valid URLs with ports.

Validation

• packages/abstractions: 184 tests passed; MyPy reported 0 issues; Pylint scored 10.00/10; YAPF and isort checks passed.
• packages/authentication/azure: 23 tests passed.
• Remote CI: license/cla, Changelog PR Guard, PullRequestConflicting, and SonarCloud are passing. Workflows requiring maintainer approval for fork PRs remain queued.

I've also updated the inline review threads with individual replies. When you have a chance, could you please take another look? Thank you for your time and feedback!

[Copilot]

🟢 Approval recommended

The focused changes address prior feedback, align with authentication-provider behavior, and have no identified blocking issues; automated tests were not run.

1 open issue

• Update Azure provider tests for rejected URLs and userinfo

3 resolved since last review

• Reject blank allowlist entries to prevent unrestricted credential sends
• Reject URLs with empty userinfo fields
• Handle malformed URLs without raising during host validation

_{Review effort: Balanced}

[Hardik K (hardikkaurani)]

Hi Vincent Biret (@baywet),

I have updated the PR with a follow-up commit addressing the remaining test assertion feedback:

• Updated test_get_authorization_token_invalid_url in test_azure_identity_access_token_provider.py to use RecordingSyncAzureTokenCredential.
• Explicitly asserted that credential.received_scopes == [] alongside token == "" for empty and malformed scheme URLs ('' and 'https://').
• Confirmed that all URL rejection paths (invalid URLs, unparseable schemes, and userinfo) strictly verify that no credential calls are dispatched.
• All unit tests across packages/abstractions (184 passed) and packages/authentication/azure (23 passed) are green.

Whenever you have a moment, please take another look. Thank you!

[Vincent Biret (baywet)]

Thanks for the contribution!

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Hardik K (hardikkaurani)]

Vincent Biret (@baywet) Thanks for helping in this.