Validate forwarded management URL origins

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 3ec5c077-6e8b-4cb3-916a-12bd3cb13937

Author: andystaples

azure-functions-durable/azure/durable_functions/client.py

@@ -62,18 +62,24 @@ def _get_request_origin(
             if separator:
                 forwarded_values[name.strip().lower()] = value.strip().strip('"')
 
-        proto = forwarded_values.get("proto", proto)
+        forwarded_proto = forwarded_values.get("proto")
+        if forwarded_proto:
+            proto = forwarded_proto
         forwarded_host = forwarded_values.get("host")
         if forwarded_host:
             return f"{proto}://{forwarded_host}"
 
     forwarded_proto = headers.get("x-forwarded-proto")
     if forwarded_proto:
-        proto = _first_forwarded_value(forwarded_proto)
+        first_proto = _first_forwarded_value(forwarded_proto)
+        if first_proto:
+            proto = first_proto
 
     forwarded_host = headers.get("x-forwarded-host")
     if forwarded_host:
-        host = _first_forwarded_value(forwarded_host)
+        first_host = _first_forwarded_value(forwarded_host)
+        if first_host:
+            host = first_host
 
     return f"{proto}://{host}"
 

azure-functions-durable/azure/durable_functions/http/http_management_payload.py

@@ -88,6 +88,9 @@ def replace_url_origin(url: str, request_origin: str | None) -> str:
 
     parsed_url = urlsplit(url)
     parsed_origin = urlsplit(request_origin)
+    if not parsed_origin.scheme or not parsed_origin.netloc:
+        raise ValueError(
+            "request_origin must include both a scheme and an authority")
     if not parsed_url.scheme or not parsed_url.netloc:
         return url
 

tests/azure-functions-durable/test_client_compat.py

@@ -16,6 +16,9 @@
     to_durabletask_status,
     to_durabletask_statuses,
 )
+from azure.durable_functions.http.http_management_payload import (
+    replace_url_origin,
+)
 from durabletask.client import AsyncTaskHubGrpcClient, OrchestrationStatus
 from durabletask.entities import EntityInstanceId
 from durabletask.task import RetryPolicy
@@ -220,6 +223,10 @@ async def test_create_http_management_payload_requires_instance_id():
          "https://public.example:8443"),
         ({"X-Forwarded-Proto": "https", "X-Forwarded-Host": "proxy.example"},
          "https://proxy.example"),
+        ({"Forwarded": "proto=;host=public.example"},
+         "http://public.example"),
+        ({"X-Forwarded-Proto": ",https"},
+         "http://request-internal:7071"),
     ],
 )
 async def test_management_payload_uses_host_templates_and_external_origin(
@@ -291,6 +298,15 @@ async def test_management_payload_without_request_preserves_template_origin():
         await client.close()
 
 
+@pytest.mark.parametrize(
+    "origin",
+    ["", "//public.example", "https:"],
+)
+def test_replace_url_origin_rejects_invalid_origin(origin):
+    with pytest.raises(ValueError, match="scheme and an authority"):
+        replace_url_origin("http://internal.example/custom/path", origin)
+
+
 async def test_host_config_uses_http_base_url_and_ignores_untrusted_forwarding():
     client = df.DurableFunctionsClient(_make_host_config())
     request = func.HttpRequest(