{"record":{"id":"553ee64bb33b4f8d","repo":"risingwavelabs/risingwave","slug":"adlsgen2-authority-host-must-not-contain-userinfo","errorCode":null,"errorMessage":"adlsgen2.authority_host must not contain userinfo","messagePattern":"adlsgen2\\.authority_host must not contain userinfo","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/connector/src/connector_common/iceberg/mod.rs","lineNumber":878,"sourceCode":"            // Defense in depth: reqsign POSTs the OAuth token request — carrying the\n            // client_secret to this host. Require a bare https origin: no userinfo,\n            // no query, no fragment, and no path beyond \"/\". The value itself is not\n            // echoed into error messages in case a user pasted a secret by mistake.\n            if let Some(host) = sp_authority {\n                let parsed = Url::parse(host).map_err(|_| {\n                    anyhow!(\n                        \"adlsgen2.authority_host does not parse as a URL ({} chars)\",\n                        host.len()\n                    )\n                })?;\n                if parsed.scheme() != \"https\" {\n                    bail!(\n                        \"adlsgen2.authority_host must use the https scheme, got {}\",\n                        parsed.scheme()\n                    );\n                }\n                if !parsed.username().is_empty() || parsed.password().is_some() {\n                    bail!(\"adlsgen2.authority_host must not contain userinfo\");\n                }\n                if parsed.query().is_some() || parsed.fragment().is_some() {\n                    bail!(\"adlsgen2.authority_host must not contain a query or fragment\");\n                }\n                if !matches!(parsed.path(), \"\" | \"/\") {\n                    bail!(\"adlsgen2.authority_host must not contain a path component\");\n                }\n            }\n\n            if let (Some(account_name), Some(account_key)) = (sk_account_name, sk_account_key) {\n                iceberg_configs.insert(ADLS_ACCOUNT_NAME.to_owned(), account_name.to_owned());\n                iceberg_configs.insert(ADLS_ACCOUNT_KEY.to_owned(), account_key.to_owned());\n                require_rest(\"adlsgen2\")?;\n            }\n\n            if let (Some(tenant_id), Some(client_id), Some(client_secret)) =\n                (sp_tenant, sp_client, sp_secret)\n            {","sourceCodeStart":860,"sourceCodeEnd":896,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/connector_common/iceberg/mod.rs#L860-L896","documentation":"As defense in depth, adlsgen2.authority_host must be a bare https origin: the connector rejects URLs containing userinfo (username or password) since the OAuth token request to this host carries the client_secret.","triggerScenarios":"Setting authority_host like 'https://user:pass@login.microsoftonline.com' or 'https://someone@host' — parsed.username() non-empty or parsed.password() present.","commonSituations":"Pasting a full credential-bearing URL copied from a browser; mistaking authority_host for a credential field; template placeholders left in like https://{user}@....","solutions":["Remove the user:password@ portion from the URL, keeping only scheme + host.","Pass credentials only via adlsgen2.client_id and adlsgen2.client_secret.","Verify the value resolves to a bare origin like https://login.microsoftonline.com/"],"exampleFix":"// before\n'adlsgen2.authority_host' = 'https://user:pass@login.microsoftonline.com'\n// after\n'adlsgen2.authority_host' = 'https://login.microsoftonline.com'","handlingStrategy":"validation","validationCode":"// reject userinfo before submitting\nfunction hasNoUserinfo(v) { try { const u = new URL(v); return u.username === '' && u.password === ''; } catch { return false; } }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Paste only the bare origin, never a URL copied from a logged-in browser session.","Pass credentials only via client_id/client_secret fields.","Audit template placeholders like {user}@ before substitution."],"tags":["iceberg","adlsgen2","security","url"],"backgroundTag":"invalid-url-format","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}