dabla commented on code in PR #69742:
URL: https://github.com/apache/airflow/pull/69742#discussion_r3564306531
##########
providers/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py:
##########
@@ -629,6 +629,13 @@ async def paginated_run(
responses: list[dict] = []
+ # The pagination link (e.g. ``@odata.nextLink``) is echoed from the
API response and is
+ # re-fetched with the connection's bearer token attached. Kiota only
scopes that token to
+ # ``allowed_hosts``, which defaults to empty (any host) unless
configured, so a tampered
+ # response could redirect the token off-host. Pin follow-up requests
to the configured
+ # endpoint's host (CWE-918).
+ allowed_netloc = urlparse((await
self.get_async_conn()).base_url).netloc
Review Comment:
I don't think `allowed_netloc` should be initialized here. The variable
itself makes sense, but it should be computed inside the `async run()` method
where it's actually used. Initializing it here unnecessarily couples this code
to the connection lookup and may perform work earlier than needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
