handle app_link query parameter Intent Redirection, Fixes AB#3590136 by rpdome · Pull Request #3102 · AzureAD/microsoft-authentication-library-common-for-android

rpdome · 2026-04-29T22:56:22Z

AB#3590136

github-actions · 2026-04-29T22:56:41Z

❌ Work item link check failed. Description does not contain AB#{ID}.

Click here to Learn more.

rpdome · 2026-04-29T22:56:46Z

@copilot update changelog with this pr id (3102)

github-actions · 2026-04-29T22:57:19Z

✅ Work item link check complete. Description contains link AB#3590136 to an Azure Boards work item.

github-actions · 2026-04-29T22:57:20Z

❌ Work item link check failed. Description contains AB#3590136 but the Bot could not link it to an Azure Boards work item.

Click here to learn more.

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/6ce19e27-5d80-4cc3-a775-6b67b229bdc6 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot · 2026-04-29T22:57:56Z

@copilot update changelog with this pr id (3102)

Done. Added the changelog entry for PR #3102 in commit b7f6052.

Copilot

Pull request overview

This PR hardens handling of app_link carried on broker-installation redirect URIs by introducing a strict allowlist validator and expanding test coverage for both safe and hostile app_link targets.

Changes:

Add BrokerInstallLinkValidator to strictly allowlist eSTS-supported broker install links (Play Store + China fwlink) and reject everything else.
Update RawAuthorizationResult to validate app_link before classifying the redirect as BROKER_INSTALLATION_TRIGGERED.
Add/extend unit tests covering additional allowlisted links and hostile app_link inputs.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
common4j/src/main/com/microsoft/identity/common/java/providers/RawAuthorizationResult.java	Enforces allowlist validation for `app_link` and rejects non-allowlisted redirects.
common4j/src/main/com/microsoft/identity/common/java/providers/BrokerInstallLinkValidator.kt	Implements strict allowlist validation logic for `app_link` URLs.
common4j/src/test/com/microsoft/identity/common/java/providers/RawAuthorizationResultTest.java	Adds tests for new allowlisted broker-install links and hostile `app_link` cases.
common4j/src/test/com/microsoft/identity/common/java/providers/Constants.java	Adds new redirect URI test constants for allowlisted and hostile `app_link` scenarios.
common4j/src/test/com/microsoft/identity/common/java/providers/BrokerInstallLinkValidatorTest.kt	Adds comprehensive positive/negative unit tests for the allowlist validator.

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/661d7c1b-a1b8-4568-b694-4d3117aee265 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot · 2026-04-29T23:16:22Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

dl.google.com
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -XX:MaxMetaspaceSize=1024m -XX:+HeapDumpOnOutOfMemoryError -Xmx3072m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant (dns block)
identitydivision.pkgs.visualstudio.com
- Triggering command: /usr/lib/jvm/temurin-17-jdk-amd64/bin/java /usr/lib/jvm/temurin-17-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED -XX:MaxMetaspaceSize=1024m -XX:+HeapDumpOnOutOfMemoryError -Xmx3072m -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant (dns block)
www.puppycrawl.com
- Triggering command: /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/tools/linux64/java/bin/java /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/tools/linux64/java/bin/java -jar /opt/hostedtoolcache/CodeQL/2.25.1/x64/codeql/xml/tools/xml-extractor.jar --fileList=/tmp/codeql-scratch-b2678d0398b00160/dbs/java/working/files-to-index4617838047093606381.list --sourceArchiveDir=/tmp/codeql-scratch-b2678d0398b00160/dbs/java/src --outputDir=/tmp/codeql-scratch-b2678d0398b00160/dbs/java/trap/java (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/49c8165b-3274-40c7-8f95-d6443af2d739 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

rpdome · 2026-05-01T03:48:57Z

@copilot can you use the same library that common/common4j uses to handle url (instead of writing our own)

…IBuilder Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/13a906dc-73b5-4f22-bcfa-0f4590d7b9b3 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot · 2026-05-01T03:53:17Z

@copilot can you use the same library that common/common4j uses to handle url (instead of writing our own)

Done in commit 1d17878. BrokerInstallLinkValidator now uses CommonURIBuilder (the Apache HC5 URIBuilder wrapper already used by the rest of the library) instead of java.net.URI + a custom parseQuery() function. Query parameters come from builder.queryParams (List<NameValuePair>), and the thin toUniqueParamMap() helper converts that list to a map while still rejecting duplicate keys to guard against parameter-smuggling attacks.

rpdome · 2026-05-08T21:50:21Z

@copilot resolve the merge conflicts in this pull request

…lLinkValidator Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/13ceb94d-f89c-41c5-bceb-26cefc278826 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot · 2026-05-08T21:52:10Z

@copilot resolve the merge conflicts in this pull request

Merge conflicts were already resolved in commit 4964f02 (merge of dev into rapong/reject).

…rInstallLinkValidator Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/06a6deb1-8715-4eca-b8ce-37327d9c84dc Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

handle app_link Intent Redirection

9498f9f

Copilot AI review requested due to automatic review settings April 29, 2026 22:56

rpdome requested a review from a team as a code owner April 29, 2026 22:56

Copilot started work on behalf of rpdome April 29, 2026 22:56 View session

Copilot started reviewing on behalf of rpdome April 29, 2026 22:57 View session

Update changelog with PR #3102

b7f6052

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/6ce19e27-5d80-4cc3-a775-6b67b229bdc6 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot AI requested a review from a team as a code owner April 29, 2026 22:57

github-actions Bot changed the title ~~handle app_link Intent Redirection~~ handle app_link Intent Redirection, Fixes AB#3590136 Apr 29, 2026

Copilot finished work on behalf of rpdome April 29, 2026 22:58

Copilot AI reviewed Apr 29, 2026

View reviewed changes

Comment thread common4j/src/main/com/microsoft/identity/common/java/providers/RawAuthorizationResult.java Outdated

Copilot started work on behalf of rpdome April 29, 2026 23:08 View session

Fix app_link rejection: use UNSUPPORTED_URL, avoid URI leak in exception

bc1a86e

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/661d7c1b-a1b8-4568-b694-4d3117aee265 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot finished work on behalf of rpdome April 29, 2026 23:16

rpdome commented Apr 30, 2026

View reviewed changes

Comment thread common4j/src/main/com/microsoft/identity/common/java/providers/RawAuthorizationResult.java Outdated

Copilot started work on behalf of rpdome April 30, 2026 20:36 View session

Move app_link allowlist check into getResultCodeFromFinalRedirectUri

31321d1

Agent-Logs-Url: https://github.com/AzureAD/microsoft-authentication-library-common-for-android/sessions/49c8165b-3274-40c7-8f95-d6443af2d739 Co-authored-by: rpdome <19558668+rpdome@users.noreply.github.com>

Copilot finished work on behalf of rpdome April 30, 2026 20:38

Copilot started work on behalf of rpdome May 1, 2026 03:49 View session

Copilot finished work on behalf of rpdome May 1, 2026 03:53

Merge branch 'dev' into rapong/reject

4964f02

rpdome changed the title ~~handle app_link Intent Redirection, Fixes AB#3590136~~ handle app_link query parameter Intent Redirection, Fixes AB#3590136 May 6, 2026

somalaya reviewed May 6, 2026

View reviewed changes

Comment thread common4j/src/main/com/microsoft/identity/common/java/providers/RawAuthorizationResult.java

somalaya reviewed May 6, 2026

View reviewed changes

Comment thread common4j/src/main/com/microsoft/identity/common/java/providers/BrokerInstallLinkValidator.kt

Copilot started work on behalf of rpdome May 8, 2026 21:50 View session

Copilot finished work on behalf of rpdome May 8, 2026 21:52

Merge branch 'dev' into rapong/reject

84bbbe1

somalaya approved these changes May 9, 2026

View reviewed changes

Copilot started work on behalf of rpdome May 11, 2026 20:02 View session

Copilot finished work on behalf of rpdome May 11, 2026 20:05

shahzaibj reviewed May 13, 2026

View reviewed changes

Comment thread common4j/src/main/com/microsoft/identity/common/java/providers/BrokerInstallLinkValidator.kt

shahzaibj approved these changes May 13, 2026

View reviewed changes

Merge branch 'dev' into rapong/reject

439a4fd

rpdome merged commit 62b7c33 into dev May 14, 2026
28 checks passed

rpdome deleted the rapong/reject branch May 14, 2026 03:53

Conversation

rpdome commented Apr 29, 2026 • edited by azure-boards Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Apr 29, 2026

Uh oh!

rpdome commented Apr 29, 2026

Uh oh!

github-actions Bot commented Apr 29, 2026

Uh oh!

github-actions Bot commented Apr 29, 2026

Uh oh!

Copilot AI commented Apr 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI commented Apr 29, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

rpdome commented May 1, 2026

Uh oh!

Copilot AI commented May 1, 2026

Uh oh!

Uh oh!

Uh oh!

rpdome commented May 8, 2026

Uh oh!

Copilot AI commented May 8, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

rpdome commented Apr 29, 2026 •

edited by azure-boards Bot

Loading