FIX: Add destination allowlist before forwarding Bearer credential to Graph in EntraAuthMiddleware

[jsong468]

Description

EntraAuthMiddleware._resolve_excess_groups_async forwards the user's Bearer credential to a host derived from token claims (_claim_sources.src1.endpoint) and from the response body (@odata.nextLink) without an explicit allowlist. There is no check that these values resolve to graph.microsoft.com before the credentialed request is made. This adds an explicit host + scheme allowlist before each request.

This is not an exploitable bug today: the endpoint originates from a signature-validated JWT and pagination links come from a TLS-authenticated Graph response. The allowlist makes the safety property local and robust against future changes and hardens the currently-dead path before it is re-enabled (see the existing NOTE about the Graph audience migration).

Changes

• pyrit/backend/middleware/auth.py
  • Add _GRAPH_HOSTS class constant ({"graph.microsoft.com"}
  • Add _is_trusted_graph_url() helper using urlparse(...).hostname (correctly handles userinfo/port, so graph.microsoft.com@evil.com-style spoofs are rejected).
  • Guard the initial POST endpoint: refuse + log + return [] if untrusted.
  • Guard each @odata.nextLink in the pagination loop: refuse + log + break if untrusted.

Tests

• tests/unit/backend/test_auth_middleware.py
  • Parametrized test of _is_trusted_graph_url (legit Graph URLs vs. http://, wrong host, suffix-spoof, userinfo-spoof, empty).
  • Async test asserting an untrusted endpoint returns [] and makes no HTTP request (token is never forwarded).