Samin061 commented on code in PR #69742:
URL: https://github.com/apache/airflow/pull/69742#discussion_r3564348228
##########
providers/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py:
##########
@@ -629,6 +629,13 @@ async def paginated_run(
responses: list[dict] = []
+ # The pagination link (e.g. ``@odata.nextLink``) is echoed from the
API response and is
+ # re-fetched with the connection's bearer token attached. Kiota only
scopes that token to
+ # ``allowed_hosts``, which defaults to empty (any host) unless
configured, so a tampered
+ # response could redirect the token off-host. Pin follow-up requests
to the configured
+ # endpoint's host (CWE-918).
+ allowed_netloc = urlparse((await
self.get_async_conn()).base_url).netloc
Review Comment:
Good point, moved it inside run() so the lookup only happens when pagination
actually runs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
