{"record":{"id":"d4e67b18744abdf2","repo":"kubernetes/kops","slug":"base-url-path-is-too-broad","errorCode":null,"errorMessage":"base URL path is too broad","messagePattern":"base URL path is too broad","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/azure/attest.go","lineNumber":503,"sourceCode":"// microsoftIntermediateCandidateURLs treats signer AIA values as untrusted input. It keeps only\n// entries that stay within the configured Microsoft PKI host/path allowlist and normalizes them\n// onto the configured scheme and host.\nfunc microsoftIntermediateCandidateURLs(baseURL string, signer *x509.Certificate) ([]string, error) {\n\tif signer == nil {\n\t\treturn nil, fmt.Errorf(\"signer certificate is required\")\n\t}\n\n\tbase, err := url.Parse(baseURL)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"parsing base URL: %w\", err)\n\t}\n\tif !base.IsAbs() || base.Host == \"\" {\n\t\treturn nil, fmt.Errorf(\"base URL must be absolute\")\n\t}\n\n\tbasePath := path.Clean(strings.TrimRight(base.Path, \"/\"))\n\tif basePath == \".\" || basePath == \"/\" {\n\t\treturn nil, fmt.Errorf(\"base URL path is too broad\")\n\t}\n\n\tvar urls []string\n\tseen := make(map[string]struct{})\n\tfor _, rawURL := range signer.IssuingCertificateURL {\n\t\tnormalized, ok := normalizeMicrosoftIntermediateURL(base, basePath, rawURL)\n\t\tif !ok {\n\t\t\tcontinue\n\t\t}\n\t\tif _, found := seen[normalized]; found {\n\t\t\tcontinue\n\t\t}\n\t\tseen[normalized] = struct{}{}\n\t\turls = append(urls, normalized)\n\t}\n\n\tif len(urls) == 0 {\n\t\treturn nil, fmt.Errorf(\"no valid Microsoft PKI AIA URLs found\")","sourceCodeStart":485,"sourceCodeEnd":521,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/azure/attest.go#L485-L521","documentation":"Allowlist guard on the intermediate-fetch base URL: its path is broader than the permitted Microsoft PKI path prefix, which would let AIA-supplied URLs escape the intended path scope. The base URL configuration is at fault.","triggerScenarios":"Thrown at upup/pkg/fi/cloudup/azure/attest.go:503 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Narrow the configured base URL path to the approved Microsoft PKI certificate path"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}