@azure/keyvault-secrets 4.5.2-alpha.20220919.6 → 4.6.0

package/dist/index.js

@@ -644,7 +644,7 @@ class KeyVaultClient extends coreHttpCompat__namespace.ExtendedServiceClient {
         const defaults = {
             requestContentType: "application/json; charset=utf-8"
         };
-        const packageDetails = `azsdk-js-keyvault-secrets/4.5.2`;
+        const packageDetails = `azsdk-js-keyvault-secrets/4.6.0`;
         const userAgentPrefix = options.userAgentOptions && options.userAgentOptions.userAgentPrefix
             ? `${options.userAgentOptions.userAgentPrefix} ${packageDetails}`
             : `${packageDetails}`;
@@ -1155,6 +1155,19 @@ function parseWWWAuthenticate(wwwAuthenticate) {
 }
 
 // Copyright (c) Microsoft Corporation.
+function verifyChallengeResource(scope, request) {
+    let scopeAsUrl;
+    try {
+        scopeAsUrl = new URL(scope);
+    }
+    catch (e) {
+        throw new Error(`The challenge contains invalid scope '${scope}'`);
+    }
+    const requestUrl = new URL(request.url);
+    if (!requestUrl.hostname.endsWith(`.${scopeAsUrl.hostname}`)) {
+        throw new Error(`The challenge resource '${scopeAsUrl.hostname}' does not match the requested domain. Set disableChallengeResourceVerification to true in your client options to disable. See https://aka.ms/azsdk/blog/vault-uri for more information.`);
+    }
+}
 /**
  * @internal
  *
@@ -1168,14 +1181,15 @@ function parseWWWAuthenticate(wwwAuthenticate) {
  *
  * Following the first request of a client, follow-up requests will get the cached token
  * if possible.
+ *
  */
-function createChallengeCallbacks() {
+function createChallengeCallbacks({ disableChallengeResourceVerification, } = {}) {
     let challengeState = { status: "none" };
     function requestToOptions(request) {
         return {
             abortSignal: request.abortSignal,
             requestOptions: {
-                timeout: request.timeout > 0 ? request.timeout : undefined,
+                timeout: request.timeout,
             },
             tracingOptions: request.tracingOptions,
         };
@@ -1223,6 +1237,9 @@ function createChallengeCallbacks() {
         if (!scope) {
             throw new Error("Missing scope.");
         }
+        if (!disableChallengeResourceVerification) {
+            verifyChallengeResource(scope, request);
+        }
         const accessToken = await options.getAccessToken([scope], Object.assign(Object.assign({}, getTokenOptions), { tenantId: parsedChallenge.tenantId }));
         if (!accessToken) {
             return false;
@@ -1410,7 +1427,7 @@ function getSecretFromSecretBundle(bundle) {
 
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
-const SDK_VERSION = "4.5.2";
+const SDK_VERSION = "4.6.0";
 
 // Copyright (c) Microsoft Corporation.
 const tracingClient = coreTracing.createTracingClient({
@@ -1627,7 +1644,7 @@ class SecretClient {
      *
      * let client = new SecretClient(vaultUrl, credentials);
      * ```
-     * @param vaultUrl - The base URL to the vault.
+     * @param vaultUrl - The base URL to the vault. You should validate that this URL references a valid Key Vault resource. See https://aka.ms/azsdk/blog/vault-uri for details.
      * @param credential - An object that implements the `TokenCredential` interface used to authenticate requests to the service. Use the \@azure/identity package to create a credential that suits your needs.
      * @param pipelineOptions - Pipeline options used to configure Key Vault API requests.
      *                          Omit this parameter to use the default pipeline configuration.
@@ -1637,7 +1654,7 @@ class SecretClient {
         const authPolicy = coreRestPipeline.bearerTokenAuthenticationPolicy({
             credential,
             scopes: [],
-            challengeCallbacks: createChallengeCallbacks(),
+            challengeCallbacks: createChallengeCallbacks(pipelineOptions),
         });
         const internalPipelineOptions = Object.assign(Object.assign({}, pipelineOptions), { loggingOptions: {
                 logger: logger.info,