oauth2: restore legacy context creation behavior#11662
Open
oauth2: restore legacy context creation behavior#11662
Conversation
Signed-off-by: Eduardo Silva <eduardo@chronosphere.io>
Signed-off-by: Eduardo Silva <eduardo@chronosphere.io>
Signed-off-by: Eduardo Silva <eduardo@chronosphere.io>
📝 WalkthroughWalkthroughThe PR fixes OAuth2 token retrieval failure in v5.0.0 by enabling the OAuth2 client by default in Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c`:
- Around line 94-113: Validate auth_url_override before assigning it: in the
branch that handles ctx->auth_url_override (before calling flb_sds_create),
ensure the provided URL uses the HTTPS scheme or is an explicit localhost
loopback HTTP (e.g., host equals "localhost" or "127.0.0.1" with any port) to
allow tests; if the scheme is plain "http" for any non-loopback host, log/return
an error, call flb_az_li_ctx_destroy(ctx) and return NULL. Implement the check
around ctx->auth_url_override parsing (inspect the prefix/host) so
flb_sds_create is only called for validated URLs and insecure cleartext token
endpoints are rejected.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a30ba3e9-a88d-4c7b-8c7d-d3a5bc6918ae
📒 Files selected for processing (5)
plugins/out_azure_logs_ingestion/azure_logs_ingestion.cplugins/out_azure_logs_ingestion/azure_logs_ingestion.hplugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.csrc/flb_oauth2.ctests/internal/oauth2.c
Comment on lines
+94
to
113
| if (ctx->auth_url_override) { | ||
| ctx->auth_url = flb_sds_create(ctx->auth_url_override); | ||
| if (!ctx->auth_url) { | ||
| flb_errno(); | ||
| flb_az_li_ctx_destroy(ctx); | ||
| return NULL; | ||
| } | ||
| } | ||
| else { | ||
| /* Allocate and set auth url */ | ||
| ctx->auth_url = flb_sds_create_size(sizeof(FLB_AZ_LI_AUTH_URL_TMPLT) - 1 + | ||
| flb_sds_len(ctx->tenant_id)); | ||
| if (!ctx->auth_url) { | ||
| flb_errno(); | ||
| flb_az_li_ctx_destroy(ctx); | ||
| return NULL; | ||
| } | ||
| flb_sds_snprintf(&ctx->auth_url, flb_sds_alloc(ctx->auth_url), | ||
| FLB_AZ_LI_AUTH_URL_TMPLT, ctx->tenant_id); | ||
| } |
There was a problem hiding this comment.
Validate auth_url_override to prevent insecure token endpoint usage.
This branch accepts any override URL, including cleartext http://, while sending client_secret in OAuth2 token requests. Please enforce HTTPS for normal use (with optional localhost-only HTTP allowance for tests).
🔒 Proposed guardrail
if (ctx->auth_url_override) {
+ if (strncasecmp(ctx->auth_url_override, "https://", 8) != 0 &&
+ strncasecmp(ctx->auth_url_override, "http://127.0.0.1", 16) != 0 &&
+ strncasecmp(ctx->auth_url_override, "http://localhost", 16) != 0) {
+ flb_plg_error(ins,
+ "property 'auth_url' must use https "
+ "(http is allowed only for localhost tests)");
+ flb_az_li_ctx_destroy(ctx);
+ return NULL;
+ }
+
ctx->auth_url = flb_sds_create(ctx->auth_url_override);
if (!ctx->auth_url) {
flb_errno();
flb_az_li_ctx_destroy(ctx);
return NULL;🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@plugins/out_azure_logs_ingestion/azure_logs_ingestion_conf.c` around lines 94
- 113, Validate auth_url_override before assigning it: in the branch that
handles ctx->auth_url_override (before calling flb_sds_create), ensure the
provided URL uses the HTTPS scheme or is an explicit localhost loopback HTTP
(e.g., host equals "localhost" or "127.0.0.1" with any port) to allow tests; if
the scheme is plain "http" for any non-loopback host, log/return an error, call
flb_az_li_ctx_destroy(ctx) and return NULL. Implement the check around
ctx->auth_url_override parsing (inspect the prefix/host) so flb_sds_create is
only called for validated URLs and insecure cleartext token endpoints are
rejected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #11649
Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.
Summary by CodeRabbit
New Features
Bug Fixes