|
| 1 | +// Copyright (c) Microsoft Corporation. |
| 2 | +// All rights reserved. |
| 3 | +// |
| 4 | +// This code is licensed under the MIT License. |
| 5 | +// |
| 6 | +// Permission is hereby granted, free of charge, to any person obtaining a copy |
| 7 | +// of this software and associated documentation files(the "Software"), to deal |
| 8 | +// in the Software without restriction, including without limitation the rights |
| 9 | +// to use, copy, modify, merge, publish, distribute, sublicense, and / or sell |
| 10 | +// copies of the Software, and to permit persons to whom the Software is |
| 11 | +// furnished to do so, subject to the following conditions : |
| 12 | +// |
| 13 | +// The above copyright notice and this permission notice shall be included in |
| 14 | +// all copies or substantial portions of the Software. |
| 15 | +// |
| 16 | +// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 17 | +// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 18 | +// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
| 19 | +// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
| 20 | +// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
| 21 | +// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN |
| 22 | +// THE SOFTWARE. |
| 23 | +package com.microsoft.identity.common.java.providers |
| 24 | + |
| 25 | +import com.microsoft.identity.common.java.util.CommonURIBuilder |
| 26 | +import org.apache.hc.core5.http.NameValuePair |
| 27 | +import java.net.URISyntaxException |
| 28 | + |
| 29 | +/** |
| 30 | + * Strict allowlist validator for the `app_link` query-parameter value carried on |
| 31 | + * a broker-installation redirect URI (`msauth://...?app_link=<url>`). |
| 32 | + * |
| 33 | + * The classifier in [RawAuthorizationResult.getResultCodeFromFinalRedirectUri] uses this to |
| 34 | + * decide whether to return [RawAuthorizationResult.ResultCode.BROKER_INSTALLATION_TRIGGERED] |
| 35 | + * (which downstream Android sinks turn into `startActivity(ACTION_VIEW, app_link)`). |
| 36 | + * |
| 37 | + * The Microsoft identity service (eSTS) only ever emits one of three concrete |
| 38 | + * `app_link` values today: |
| 39 | + * 1. `https://play.google.com/store/apps/details?id=com.azure.authenticator` |
| 40 | + * 2. `https://play.google.com/store/apps/details?id=com.microsoft.windowsintune.companyportal` |
| 41 | + * 3. `https://go.microsoft.com/fwlink/?linkid=2134649` (China Company Portal) |
| 42 | + * Each may carry an optional `referrer` parameter set by the server. |
| 43 | + */ |
| 44 | +object BrokerInstallLinkValidator { |
| 45 | + |
| 46 | + private const val SCHEME_HTTPS = "https" |
| 47 | + private const val HOST_PLAY = "play.google.com" |
| 48 | + private const val HOST_FWLINK = "go.microsoft.com" |
| 49 | + private const val PATH_PLAY = "/store/apps/details" |
| 50 | + private const val PATH_FWLINK = "/fwlink" |
| 51 | + private const val PATH_FWLINK_TRAILING = "/fwlink/" |
| 52 | + |
| 53 | + private const val PARAM_ID = "id" |
| 54 | + private const val PARAM_LINKID = "linkid" |
| 55 | + private const val PARAM_REFERRER = "referrer" |
| 56 | + |
| 57 | + private val ALLOWED_PACKAGE_IDS = setOf( |
| 58 | + "com.azure.authenticator", |
| 59 | + "com.microsoft.windowsintune.companyportal" |
| 60 | + ) |
| 61 | + |
| 62 | + private val ALLOWED_FWLINK_IDS = setOf("2134649") |
| 63 | + |
| 64 | + /** |
| 65 | + * @return `true` iff [url] decodes to one of the allowlisted broker-install |
| 66 | + * destinations defined above; `false` for any other input (including null, |
| 67 | + * blank, malformed, or attacker-controlled values). |
| 68 | + */ |
| 69 | + @JvmStatic |
| 70 | + fun isSafeBrokerInstallLink(url: String?): Boolean { |
| 71 | + if (url.isNullOrBlank()) return false |
| 72 | + |
| 73 | + val builder: CommonURIBuilder = try { |
| 74 | + CommonURIBuilder(url) |
| 75 | + } catch (e: URISyntaxException) { |
| 76 | + return false |
| 77 | + } |
| 78 | + |
| 79 | + // Scheme must be exactly https (case-insensitive). |
| 80 | + if (!SCHEME_HTTPS.equals(builder.scheme, ignoreCase = true)) return false |
| 81 | + |
| 82 | + // Reject embedded credentials, fragments, and non-default ports. |
| 83 | + if (builder.userInfo != null) return false |
| 84 | + if (builder.fragment != null) return false |
| 85 | + if (builder.port != -1) return false |
| 86 | + |
| 87 | + val host = builder.host ?: return false |
| 88 | + val path = builder.path ?: return false |
| 89 | + |
| 90 | + // Use getQueryParams() from CommonURIBuilder to parse query parameters. |
| 91 | + // toUniqueParamMap returns null if any key appears more than once, defending |
| 92 | + // against parameter-smuggling attacks such as ?id=safe&id=evil. |
| 93 | + val params = toUniqueParamMap(builder.queryParams) ?: return false |
| 94 | + |
| 95 | + return when { |
| 96 | + HOST_PLAY.equals(host, ignoreCase = true) -> isValidPlayLink(path, params) |
| 97 | + HOST_FWLINK.equals(host, ignoreCase = true) -> isValidFwlink(path, params) |
| 98 | + else -> false |
| 99 | + } |
| 100 | + } |
| 101 | + |
| 102 | + private fun isValidPlayLink(path: String, params: Map<String, String>): Boolean { |
| 103 | + if (path != PATH_PLAY) return false |
| 104 | + val id = params[PARAM_ID] ?: return false |
| 105 | + if (!ALLOWED_PACKAGE_IDS.any { it.equals(id, ignoreCase = true) }) return false |
| 106 | + return hasOnlyAllowedExtras(params, PARAM_ID) |
| 107 | + } |
| 108 | + |
| 109 | + private fun isValidFwlink(path: String, params: Map<String, String>): Boolean { |
| 110 | + if (path != PATH_FWLINK && path != PATH_FWLINK_TRAILING) return false |
| 111 | + val linkId = params[PARAM_LINKID] ?: return false |
| 112 | + if (linkId !in ALLOWED_FWLINK_IDS) return false |
| 113 | + return hasOnlyAllowedExtras(params, PARAM_LINKID) |
| 114 | + } |
| 115 | + |
| 116 | + private fun hasOnlyAllowedExtras(params: Map<String, String>, requiredKey: String): Boolean { |
| 117 | + for (key in params.keys) { |
| 118 | + if (key == requiredKey) continue |
| 119 | + if (key == PARAM_REFERRER) continue |
| 120 | + return false |
| 121 | + } |
| 122 | + return true |
| 123 | + } |
| 124 | + |
| 125 | + /** |
| 126 | + * Converts a [NameValuePair] list (from [CommonURIBuilder.getQueryParams]) into a map. |
| 127 | + * |
| 128 | + * Returns `null` if any key appears more than once — this defends against |
| 129 | + * parameter-smuggling attacks such as `?id=safe&id=evil` where a permissive |
| 130 | + * parser might pick the wrong value. |
| 131 | + */ |
| 132 | + private fun toUniqueParamMap(pairs: List<NameValuePair>): Map<String, String>? { |
| 133 | + val out = LinkedHashMap<String, String>() |
| 134 | + for (pair in pairs) { |
| 135 | + if (out.containsKey(pair.name)) return null |
| 136 | + out[pair.name] = pair.value ?: "" |
| 137 | + } |
| 138 | + return out |
| 139 | + } |
| 140 | +} |
0 commit comments