fix: enforce host checking before exchanging a refresh token

pkg/common/oras/authprovider/azure/azureidentity.go

@@ -67,11 +67,13 @@
 	authClientFactory       AuthClientFactory
 	registryHostGetter      RegistryHostGetter
 	getManagedIdentityToken ManagedIdentityTokenGetter
+	endpoints               []string
 }
 
 type azureManagedIdentityAuthProviderConf struct {
-	Name     string `json:"name"`
-	ClientID string `json:"clientID"`
+	Name      string   `json:"name"`
+	ClientID  string   `json:"clientID"`
+	Endpoints []string `json:"endpoints,omitempty"`
 }
 
 const (
@@ -109,6 +111,15 @@
 	if err != nil {
 		return nil, err
 	}
+
+	if len(conf.Endpoints) == 0 {
+		conf.Endpoints = []string{defaultACREndpoint}
+	} else {
+		if err := validateEndpoints(conf.Endpoints); err != nil {
+			return nil, re.ErrorCodeConfigInvalid.WithError(err)
+		}
+	}
+
 	// retrieve an AAD Access token
 	token, err := getManagedIdentityToken(context.Background(), client, azidentity.NewManagedIdentityCredential)
 	if err != nil {
@@ -121,6 +132,7 @@
 		tenantID:                tenant,
 		authClientFactory:       &defaultAuthClientFactoryImpl{},          // Concrete implementation
 		getManagedIdentityToken: &defaultManagedIdentityTokenGetterImpl{}, // Concrete implementation
+		endpoints:               conf.Endpoints,
 	}, nil
 }
 
@@ -155,6 +167,10 @@
 		return provider.AuthConfig{}, re.ErrorCodeHostNameInvalid.WithComponentType(re.AuthProvider)
 	}
 
+	if err := validateHost(artifactHostName, d.endpoints); err != nil {
+		return provider.AuthConfig{}, re.ErrorCodeHostNameInvalid.WithError(err)
+	}
+
 	// need to refresh AAD token if it's expired
 	if time.Now().Add(time.Minute * 5).After(d.identityToken.ExpiresOn) {
 		newToken, err := d.getManagedIdentityToken.GetManagedIdentityToken(ctx, d.clientID)

pkg/common/oras/authprovider/azure/azureidentity_test.go

@@ -167,6 +167,7 @@ func TestMIAuthProvider_Provide_TokenRefreshSuccess(t *testing.T) {
 		authClientFactory:       mockAuthClientFactory,
 		registryHostGetter:      mockRegistryHostGetter,
 		getManagedIdentityToken: mockManagedIdentityTokenGetter,
+		endpoints:               []string{"example.azurecr.io"},
 	}
 
 	// Call Provide method
@@ -200,6 +201,7 @@ func TestMIAuthProvider_Provide_TokenRefreshFailure(t *testing.T) {
 		authClientFactory:       mockAuthClientFactory,
 		registryHostGetter:      mockRegistryHostGetter,
 		getManagedIdentityToken: mockManagedIdentityTokenGetter,
+		endpoints:               []string{"example.azurecr.io"},
 	}
 
 	// Call Provide method

pkg/common/oras/authprovider/azure/azureworkloadidentity.go

@@ -18,7 +18,9 @@
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"os"
+	"strings"
 	"time"
 
 	azcontainerregistry "github.com/Azure/azure-sdk-for-go/sdk/containers/azcontainerregistry"
@@ -72,11 +74,13 @@
 	registryHostGetter RegistryHostGetter
 	getAADAccessToken  AADAccessTokenGetter
 	reportMetrics      MetricsReporter
+	endpoints          []string
 }
 
 type azureWIAuthProviderConf struct {
-	Name     string `json:"name"`
-	ClientID string `json:"clientID,omitempty"`
+	Name      string   `json:"name"`
+	ClientID  string   `json:"clientID,omitempty"`
+	Endpoints []string `json:"endpoints,omitempty"`
 }
 
 const (
@@ -113,6 +117,14 @@
 		}
 	}
 
+	if len(conf.Endpoints) == 0 {
+		conf.Endpoints = []string{defaultACREndpoint}
+	} else {
+		if err := validateEndpoints(conf.Endpoints); err != nil {
+			return nil, re.ErrorCodeConfigInvalid.WithError(err)
+		}
+	}
+
 	// retrieve an AAD Access token
 	token, err := defaultGetAADAccessToken(context.Background(), tenant, clientID, AADResource)
 	if err != nil {
@@ -127,6 +139,7 @@
 		registryHostGetter: &defaultRegistryHostGetterImpl{},   // Concrete implementation
 		getAADAccessToken:  &defaultAADAccessTokenGetterImpl{}, // Concrete implementation
 		reportMetrics:      &defaultMetricsReporterImpl{},
+		endpoints:          conf.Endpoints,
 	}, nil
 }
 
@@ -157,6 +170,10 @@
 		return provider.AuthConfig{}, re.ErrorCodeHostNameInvalid.WithComponentType(re.AuthProvider)
 	}
 
+	if err := validateHost(artifactHostName, d.endpoints); err != nil {
+		return provider.AuthConfig{}, re.ErrorCodeHostNameInvalid.WithError(err)
+	}
+
 	// need to refresh AAD token if it's expired
 	if time.Now().Add(time.Minute * 5).After(d.aadToken.ExpiresOn) {
 		newToken, err := d.getAADAccessToken.GetAADAccessToken(ctx, d.tenantID, d.clientID, AADResource)
@@ -205,6 +222,56 @@
 	return authConfig, nil
 }
 
+// validateEndpoints checks if the endpoints are valid for auth provider.
+// A valid endpoint is either a fully qualified domain name or a wildcard domain
+// name folloiwing RFC 1034.
+// Valid examples:
+// - *.example.com
+// - example.com
+//
+// Invalid examples:
+// - *
+// - example.*
+// - *example.com.*
+func validateEndpoints(endpoints []string) error {
+	for _, endpoint := range endpoints {
+		switch strings.Count(endpoint, "*") {
+		case 0:
+			continue
+		case 1:
+			if !strings.HasPrefix(endpoint, "*.") {
+				return fmt.Errorf("invalid wildcard domain name: %s, it must start with '*.'", endpoint)
+			}
+			if len(endpoint) < 3 {
+				return fmt.Errorf("invalid wildcard domain name: %s, it must have at least one character after '*.'", endpoint)
+			}
+		default:
+			return fmt.Errorf("invalid wildcard domain name: %s, it must have at most one wildcard character", endpoint)
+		}
+	}
+	return nil
+}
+
+// validateHost checks if the host is matching endpoints supported by the auth
+// provider.
+func validateHost(host string, endpoints []string) error {
+	for _, endpoint := range endpoints {
+		switch strings.Count(endpoint, "*") {
+		case 0:
+			if host == endpoint {
+				return nil
+			}
+		case 1:
+			if strings.HasSuffix(host, strings.TrimPrefix(endpoint, "*")) {
+				return nil
+			}
+		default:
+			continue
+		}
+	}
+	return fmt.Errorf("the artifact host %s is not in the scope of the store auth provider", host)
+}
+
 // Compare addExpiry with default ACR refresh token expiry
 func getACRExpiryIfEarlier(aadExpiry time.Time) time.Time {
 	// set default refresh token expiry to default ACR expiry - 5 minutes

pkg/common/oras/authprovider/azure/azureworkloadidentity_test.go

@@ -82,6 +82,7 @@ func TestWIAuthProvider_Provide_Success(t *testing.T) {
 		registryHostGetter: mockRegistryHostGetter,
 		getAADAccessToken:  mockAADAccessTokenGetter,
 		reportMetrics:      mockMetricsReporter,
+		endpoints:          []string{"example.azurecr.io"},
 	}
 
 	// Call Provide method
@@ -126,6 +127,7 @@ func TestWIAuthProvider_Provide_RefreshToken(t *testing.T) {
 		registryHostGetter: mockRegistryHostGetter,
 		getAADAccessToken:  mockAADAccessTokenGetter,
 		reportMetrics:      mockMetricsReporter,
+		endpoints:          []string{"example.azurecr.io"},
 	}
 
 	// Call Provide method
@@ -161,6 +163,7 @@ func TestWIAuthProvider_Provide_AADTokenFailure(t *testing.T) {
 		registryHostGetter: mockRegistryHostGetter,
 		getAADAccessToken:  mockAADAccessTokenGetter,
 		reportMetrics:      mockMetricsReporter,
+		endpoints:          []string{"example.azurecr.io"},
 	}
 
 	// Call Provide method
@@ -238,6 +241,7 @@ func TestWIAuthProvider_Provide_TokenRefresh_Success(t *testing.T) {
 		registryHostGetter: mockRegistryHostGetter,
 		getAADAccessToken:  mockAADAccessTokenGetter,
 		reportMetrics:      mockMetricsReporter,
+		endpoints:          []string{"example.azurecr.io"},
 	}
 
 	// Call Provide method
@@ -273,6 +277,7 @@ func TestWIAuthProvider_Provide_TokenRefreshFailure(t *testing.T) {
 		registryHostGetter: mockRegistryHostGetter,
 		getAADAccessToken:  mockAADAccessTokenGetter,
 		reportMetrics:      mockMetricsReporter,
+		endpoints:          []string{"example.azurecr.io"},
 	}
 
 	// Call Provide method

pkg/common/oras/authprovider/azure/const.go

@@ -25,6 +25,7 @@ const (
 	dockerTokenLoginUsernameGUID               = "00000000-0000-0000-0000-000000000000"
 	AADResource                                = "https://containerregistry.azure.net/.default"
 	defaultACRExpiryDuration     time.Duration = 3 * time.Hour
+	defaultACREndpoint                         = ".*.azurecr.io"
 )
 
 var logOpt = logger.Option{