Add Foundry client and server #61
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| def _matcher(request: requests.Request) -> requests.Response | None: | ||
| """Mock requests that check for the existence of blobs.""" | ||
| if "blob.core.windows.net/" in request.url: |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 13 hours ago
To fix the problem, we need to parse the URL and check the hostname properly instead of using a substring check. This can be done using the urlparse function from the urllib.parse module. We will extract the hostname from the URL and ensure it matches the expected host "blob.core.windows.net".
- Parse the URL using
urlparse. - Extract the hostname from the parsed URL.
- Check if the hostname matches "blob.core.windows.net".
- Update the code in the
_matcherfunction to implement these changes.
| @@ -18,7 +18,9 @@ | ||
| """Mock requests that check for the existence of blobs.""" | ||
| if "blob.core.windows.net/" in request.url: | ||
| from urllib.parse import urlparse | ||
| parsed_url = urlparse(request.url) | ||
| if parsed_url.hostname == "blob.core.windows.net": | ||
| # Split off the SAS token. | ||
| path, _ = request.url.split("?", 1) | ||
| path, _ = parsed_url.path.split("?", 1) | ||
| # Split off the storage account URL. | ||
| _, path = path.split("blob.core.windows.net/", 1) | ||
| path = path.lstrip('/') | ||
|
|
|
|
||
| def _matcher(request: requests.Request) -> requests.Response | None: | ||
| """Mock requests that check for the existence of blobs.""" | ||
| if "blob.core.windows.net/" in request.url: |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 13 hours ago
To fix the problem, we need to parse the URL and check its hostname to ensure it matches the expected domain. This can be done using the urlparse function from the urllib.parse module. Specifically, we should extract the hostname from the URL and verify that it ends with "blob.core.windows.net".
- Parse the URL using
urlparse. - Extract the hostname from the parsed URL.
- Check if the hostname ends with "blob.core.windows.net".
- Update the
_matcherfunction to implement these changes.
| @@ -57,3 +57,5 @@ | ||
| """Mock requests that check for the existence of blobs.""" | ||
| if "blob.core.windows.net/" in request.url: | ||
| from urllib.parse import urlparse | ||
| parsed_url = urlparse(request.url) | ||
| if parsed_url.hostname and parsed_url.hostname.endswith("blob.core.windows.net"): | ||
| # Split off the SAS token. |
|
|
||
| def _matcher(request: requests.Request) -> requests.Response | None: | ||
| """Mock requests that check for the existence of blobs.""" | ||
| if "blob.core.windows.net/" in request.url: |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 9 hours ago
To fix the problem, we need to parse the URL and check the hostname instead of performing a substring check on the raw URL string. This ensures that the check is accurate and not prone to bypasses.
- Use the
urlparsefunction from theurllib.parsemodule to parse the URL. - Extract the hostname from the parsed URL and check if it matches the expected hostname "blob.core.windows.net".
- Update the
_matcherfunction to perform this check.
| @@ -9,2 +9,3 @@ | ||
| from typing import Generator | ||
| from urllib.parse import urlparse | ||
|
|
||
| @@ -102,7 +103,6 @@ | ||
| """Mock requests that check for the existence of blobs.""" | ||
| if "blob.core.windows.net/" in request.url: | ||
| parsed_url = urlparse(request.url) | ||
| if parsed_url.hostname == "blob.core.windows.net": | ||
| # Split off the SAS token. | ||
| path, _ = request.url.split("?", 1) | ||
| # Split off the storage account URL. | ||
| _, path = path.split("blob.core.windows.net/", 1) | ||
| path = parsed_url.path.lstrip('/') | ||
|
|
|
|
||
| def _matcher(request: requests.Request) -> requests.Response | None: | ||
| """Mock requests that check for the existence of blobs.""" | ||
| if "blob.core.windows.net/" in request.url: |
Check failure
Code scanning / CodeQL
Incomplete URL substring sanitization High test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 9 hours ago
To fix the problem, we should parse the URL and check the hostname instead of using a substring check. This ensures that the check is performed on the correct part of the URL and prevents bypassing the security check by embedding the allowed host in an unexpected location.
The best way to fix the problem is to use the urlparse function from the urllib.parse module to extract the hostname from the URL and then check if it matches the expected hostname. This approach is more robust and aligns with the recommended practices.
| @@ -102,7 +102,7 @@ | ||
| """Mock requests that check for the existence of blobs.""" | ||
| if "blob.core.windows.net/" in request.url: | ||
| from urllib.parse import urlparse | ||
| parsed_url = urlparse(request.url) | ||
| if parsed_url.hostname == "blob.core.windows.net": | ||
| # Split off the SAS token. | ||
| path, _ = request.url.split("?", 1) | ||
| # Split off the storage account URL. | ||
| _, path = path.split("blob.core.windows.net/", 1) | ||
| path, _ = parsed_url.path.split("?", 1) | ||
|
|
Add code and documentation for a Foundry client and server.