feat(core): add host validation to GoogleCredentialProvider (#5962)

Co-authored-by: Brian Ray <62354532+emeryray2002@users.noreply.github.com>
This commit is contained in:
cornmander 2025-08-11 12:40:30 -04:00 committed by GitHub
parent b0b12af2ce
commit aa5c80dec4
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 73 additions and 13 deletions

View File

@ -12,34 +12,78 @@ import { MCPServerConfig } from '../config/config.js';
vi.mock('google-auth-library');
describe('GoogleCredentialProvider', () => {
const validConfig = {
url: 'https://test.googleapis.com',
oauth: {
scopes: ['scope1', 'scope2'],
},
} as MCPServerConfig;
it('should throw an error if no scopes are provided', () => {
expect(() => new GoogleCredentialProvider()).toThrow(
const config = {
url: 'https://test.googleapis.com',
} as MCPServerConfig;
expect(() => new GoogleCredentialProvider(config)).toThrow(
'Scopes must be provided in the oauth config for Google Credentials provider',
);
});
it('should use scopes from the config if provided', () => {
new GoogleCredentialProvider(validConfig);
expect(GoogleAuth).toHaveBeenCalledWith({
scopes: ['scope1', 'scope2'],
});
});
it('should throw an error for a non-allowlisted host', () => {
const config = {
url: 'https://example.com',
oauth: {
scopes: ['scope1', 'scope2'],
},
} as MCPServerConfig;
expect(() => new GoogleCredentialProvider(config)).toThrow(
'Host "example.com" is not an allowed host for Google Credential provider.',
);
});
it('should allow luci.app', () => {
const config = {
url: 'https://luci.app',
oauth: {
scopes: ['scope1', 'scope2'],
},
} as MCPServerConfig;
new GoogleCredentialProvider(config);
expect(GoogleAuth).toHaveBeenCalledWith({
scopes: ['scope1', 'scope2'],
});
});
it('should allow sub.luci.app', () => {
const config = {
url: 'https://sub.luci.app',
oauth: {
scopes: ['scope1', 'scope2'],
},
} as MCPServerConfig;
new GoogleCredentialProvider(config);
});
it('should not allow googleapis.com without a subdomain', () => {
const config = {
url: 'https://googleapis.com',
oauth: {
scopes: ['scope1', 'scope2'],
},
} as MCPServerConfig;
expect(() => new GoogleCredentialProvider(config)).toThrow(
'Host "googleapis.com" is not an allowed host for Google Credential provider.',
);
});
describe('with provider instance', () => {
let provider: GoogleCredentialProvider;
beforeEach(() => {
const config = {
oauth: {
scopes: ['scope1', 'scope2'],
},
} as MCPServerConfig;
provider = new GoogleCredentialProvider(config);
provider = new GoogleCredentialProvider(validConfig);
vi.clearAllMocks();
});

View File

@ -14,6 +14,8 @@ import {
import { GoogleAuth } from 'google-auth-library';
import { MCPServerConfig } from '../config/config.js';
const ALLOWED_HOSTS = [/^.+\.googleapis\.com$/, /^(.*\.)?luci\.app$/];
export class GoogleCredentialProvider implements OAuthClientProvider {
private readonly auth: GoogleAuth;
@ -29,6 +31,20 @@ export class GoogleCredentialProvider implements OAuthClientProvider {
private _clientInformation?: OAuthClientInformationFull;
constructor(private readonly config?: MCPServerConfig) {
const url = this.config?.url || this.config?.httpUrl;
if (!url) {
throw new Error(
'URL must be provided in the config for Google Credentials provider',
);
}
const hostname = new URL(url).hostname;
if (!ALLOWED_HOSTS.some((pattern) => pattern.test(hostname))) {
throw new Error(
`Host "${hostname}" is not an allowed host for Google Credential provider.`,
);
}
const scopes = this.config?.oauth?.scopes;
if (!scopes || scopes.length === 0) {
throw new Error(

View File

@ -568,7 +568,7 @@ describe('mcp-client', () => {
const transport = await createTransport(
'test-server',
{
httpUrl: 'http://test-server',
httpUrl: 'http://test.googleapis.com',
authProviderType: AuthProviderType.GOOGLE_CREDENTIALS,
oauth: {
scopes: ['scope1'],
@ -587,7 +587,7 @@ describe('mcp-client', () => {
const transport = await createTransport(
'test-server',
{
url: 'http://test-server',
url: 'http://test.googleapis.com',
authProviderType: AuthProviderType.GOOGLE_CREDENTIALS,
oauth: {
scopes: ['scope1'],
@ -615,7 +615,7 @@ describe('mcp-client', () => {
false,
),
).rejects.toThrow(
'No URL configured for Google Credentials MCP server',
'URL must be provided in the config for Google Credentials provider',
);
});
});