fix: respect token_uri from json in UserCredentials creation. #1630
Conversation
| String tokenUrl = (String) json.get("token_uri"); | ||
| URI tokenUri = (tokenUrl == null || tokenUrl.isEmpty()) ? null : URI.create(tokenUrl); |
There was a problem hiding this comment.
qq, is this a value that exists? I was looking at my credentials.json file in the well known ADC path and I don't think I see an entry for tokenUri. Perhaps I needed additional flags for gcloud application-default login?
There was a problem hiding this comment.
I don't think this exists in the standard credentials.json file. Rather iiuc, we are providing a workaround that if user edit their json file and add this field, we use value from it. (ref: http://b/382442857#comment73)
There was a problem hiding this comment.
Can we add that as a quick comment above? I'm not entirely sure that this is going to be permanent/ how long we intend to support this.
And given the prior stuff about malicious URIs, perhaps a warning about modifying the token_uri/ using a JSON with a malicious token_uri?
There was a problem hiding this comment.
Good point. Although in this case, user has to explicitly provide this. @sai-sunder-s do we need to add similar warning here?
There was a problem hiding this comment.
I do not think we need a warning here because even if url is malicious, we will be sending it a token that is built purely using the data in the json.
|
| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | org.flywaydb.flyway | plugin | misk/gradle/libs.versions.toml | gradle | patch | `11.3.0` -> `11.3.1` | | [com.google.auth:google-auth-library-oauth2-http](https://github.com/googleapis/google-auth-library-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.31.0` -> `1.32.0` | | [com.google.auth:google-auth-library-credentials](https://github.com/googleapis/google-auth-library-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.31.0` -> `1.32.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.12` -> `2.30.13` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.12` -> `2.30.13` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.12` -> `2.30.13` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.12` -> `2.30.13` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.12` -> `2.30.13` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.12` -> `2.30.13` | --- ### Release Notes <details> <summary>googleapis/google-auth-library-java (com.google.auth:google-auth-library-oauth2-http)</summary> ### [`v1.32.0`](https://github.com/googleapis/google-auth-library-java/blob/HEAD/CHANGELOG.md#1320-2025-02-04) ##### Features - Introduce Client-Side Credential Access Boundary (CAB) functionality ([#​1629](googleapis/google-auth-library-java#1629)) ([f481123](googleapis/google-auth-library-java@f481123)) ##### Bug Fixes - Handle 404 and non 200 Status Code from MDS Identity Token calls ([#​1636](googleapis/google-auth-library-java#1636)) ([152c851](googleapis/google-auth-library-java@152c851)) - Respect token_uri from json in UserCredentials creation. ([#​1630](googleapis/google-auth-library-java#1630)) ([f92cc4f](googleapis/google-auth-library-java@f92cc4f)) ##### Documentation - Re-organize the README + Add a section on migrating to GoogleCredentials ([#​1644](googleapis/google-auth-library-java#1644)) ([30b26b2](googleapis/google-auth-library-java@30b26b2)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: f984e57edb0f670423a82dec1bcfe012849eb91d
context: b/382442857