Samin061 commented on code in PR #69742:
URL: https://github.com/apache/airflow/pull/69742#discussion_r3568193622
##########
providers/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py:
##########
@@ -633,6 +633,13 @@ async def run(
url: str = "",
query_parameters: dict[str, Any] | None = None,
):
+ # The pagination link (e.g. ``@odata.nextLink``) is echoed from
the API response and is
+ # re-fetched with the connection's bearer token attached. Kiota
only scopes that token to
+ # ``allowed_hosts``, which defaults to empty (any host) unless
configured, so a tampered
+ # response could redirect the token off-host. Pin follow-up
requests to the configured
+ # endpoint's host (CWE-918).
+ allowed_netloc = urlparse((await
self.get_async_conn()).base_url).netloc
+
Review Comment:
Done. Resolved allowed_netloc once in get_async_conn (from
request_adapter.base_url) and store it on self, initialized to None in
__init__. The per-run lookup and local variable are gone, and the check plus
error message now use self.allowed_netloc.
##########
providers/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/msgraph.py:
##########
Review Comment:
Moved it there. allowed_netloc is now computed from the request adapter's
base_url right where the adapter is resolved, so it only happens once per
adapter and there are no extra connection lookups during pagination.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
