[Storage] Validate account endpoints before attaching SAS credentials

[YangAn-microsoft]

🤖 PR Validation — ️✔️ All clear

Breaking Changes	Tests
️✔️ None	️✔️ 130/130

Related command

az storage copy
az storage fs directory upload
az storage fs directory download

Description

Validate the actual destination origin before generating or attaching storage SAS credentials. The previous copy URL recognition used a substring regex, allowing Azure-looking hostnames to be treated as storage endpoints.

• Reuse the origin normalization introduced in {Storage} Validate blob copy source endpoint #34138 through shared Storage URL helpers (DNS case/trailing dots, IDNA, default ports and IPv6), retaining the previous blob-copy behavior.
• Validate normalized URL origins against account endpoints using the active cloud configuration, or explicitly configured connection-string endpoints resolved by the Storage SDK.
• Preserve an explicitly selected credential account rather than replacing it from the copy URL.
• Apply the shared check to generated and supplied SAS credentials, including filesystem directory upload/download callers.
• Leave external copy URLs unchanged without adding Azure storage credentials.
• Preserve configured custom endpoints, secondary endpoints, and SAS-only Blob/File connection strings. SAS permissions and lifetime are unchanged.
• Add offline validator regression coverage and a mocked command-level test; no attacker endpoint is contacted.

This is a draft pending final review and CI. The filesystem callers are hardened at the shared boundary; this does not claim a separately demonstrated exploit through those commands.

Testing Guide

Rerun on the clean branch based on upstream dev at 8112200cfa. Set repository source imports in PowerShell:

$env:PYTHONPATH = "$PWD\src\azure-cli;$PWD\src\azure-cli-core;$PWD\src\azure-cli-telemetry;$PWD\src\azure-cli-testsdk"

• & '.\.tmp_style_env\Scripts\python.exe' -m unittest azure.cli.command_modules.storage.tests.latest.test_storage_validators azure.cli.command_modules.storage.tests.latest.test_storage_url_helpers azure.cli.command_modules.storage.tests.latest.test_storage_azcopy_scenarios.StorageAzcopyEndpointTests azure.cli.command_modules.storage.tests.latest.test_storage_blob_copy_scenarios.StorageBlobCopySecurityTests — Passed: 60 tests. Transfer and SAS generation are mocked in the command-level regression test.
• & '.\.tmp_style_env\Scripts\python.exe' -m pylint --rcfile .\pylintrc .\src\azure-cli\azure\cli\command_modules\storage\_validators.py .\src\azure-cli\azure\cli\command_modules\storage\storage_url_helpers.py .\src\azure-cli\azure\cli\command_modules\storage\operations\blob.py — Passed: 10.00/10.
• git diff --check — Passed before committing.
• & '.\.tmp_style_env\Scripts\python.exe' -m flake8 --append-config .\.flake8 .\src\azure-cli\azure\cli\command_modules\storage\_validators.py .\src\azure-cli\azure\cli\command_modules\storage\tests\latest\test_storage_validators.py .\src\azure-cli\azure\cli\command_modules\storage\tests\latest\test_storage_azcopy_scenarios.py — Failed on pre-existing test-file E302/E122 findings; compared against HEAD before rebasing and confirmed no remaining new findings.
• & '.\.tmp_style_env\Scripts\python.exe' -m azdev style storage --pylint — Blocked by local azdev repository/extension configuration; direct repository-configured pylint passed as above.
• Full azdev command linter, full storage replay suite, and live storage replay were not completed successfully. No live vulnerability replay was performed.
• Local commit/push hooks reported a missing Python activation script and exited zero; they did not provide additional validation.

History Notes

[Storage] az storage copy, az storage fs directory upload/download: Validate configured account endpoints before attaching SAS credentials

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[Copilot]

🔵 Needs a closer look

Credential-boundary changes need human review, with an unresolved copy regression and incomplete broader storage validation.

1 open finding

• Allow spaces in SAS wildcard paths · New

What changed in this PR

Hardens storage copy and filesystem transfers by validating account endpoints before attaching SAS credentials.

Changes:

• Replaces substring matching with parsed-origin validation.
• Preserves credential account selection and supports configured endpoints.
• Adds offline validator and mocked command-level regression tests.

File	Description
src/​azure-cli/​azure/​cli/​command_modules/​storage/​tests/​latest/​test_storage_validators.py	Adds endpoint and credential validation coverage.
src/​azure-cli/​azure/​cli/​command_modules/​storage/​tests/​latest/​test_storage_azcopy_scenarios.py	Adds mocked storage copy regression coverage.
src/​azure-cli/​azure/​cli/​command_modules/​storage/​_validators.py	Validates endpoint origins before attaching SAS credentials.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Security-sensitive credential routing warrants final human review, particularly while broader storage replay and CI validation remain incomplete.

0 open findings

1 resolved since last review

• Allow spaces in SAS wildcard paths

🧠 Review effort: Balanced

[Copilot]

🔵 Needs a closer look

Security-sensitive credential routing needs final human review, particularly while broader storage replay validation remains incomplete.

0 open findings

🧠 Review effort: Balanced

[Yong Zhang (yonzhan)]

Storage