Description

EntraAuthMiddleware._resolve_excess_groups_async forwards the user's Bearer credential to a host derived from token claims (_claim_sources.src1.endpoint) and from the response body (@odata.nextLink). There was no check that these values resolve to graph.microsoft.com before the credentialed request was made.

Rather than validating the token-supplied endpoint with an allowlist, this removes it from the request entirely: the group-resolution URL is now built from a trusted, deployment-known constant (_GRAPH_MEMBER_OBJECTS_URL), so token data cannot control the request host, path, or port. Eliminating the untrusted input is stronger than validating it; there is no longer an attacker-influenced value in the initial request to get wrong. Pagination links (@odata.nextLink) come from the Graph response body and cannot be constructed from a constant, so those retain an explicit host + scheme allowlist.

This is not an exploitable bug today: the endpoint originates from a signature-validated JWT and pagination links come from a TLS-authenticated Graph response. The change makes the safety property local and robust against future changes and hardens the currently-dead path before it is re-enabled (see the existing NOTE about the Graph audience migration).

Changes

• pyrit/backend/middleware/auth.py
  • Add _GRAPH_MEMBER_OBJECTS_URL constant and build the initial group-resolution request from it, ignoring the token-supplied endpoint.
  • Detect the group overage per the documented Entra structure: _claim_names["groups"] → source key → _claim_sources (replaces the hardcoded src1 / .endpoint read).
  • Add _GRAPH_HOSTS + _is_trusted_graph_url() (using urlparse(...).hostname, so graph.microsoft.com@evil.com-style spoofs are rejected) and guard each @odata.nextLink in the pagination loop.

Tests

• tests/unit/backend/test_auth_middleware.py
  • Parametrized test of _is_trusted_graph_url (legit Graph URLs vs. http://, wrong host, suffix-spoof, userinfo-spoof, empty).
  • Async test asserting no HTTP request is made when there is no group overage.
  • Async test asserting the request goes to the trusted constant URL even when the token endpoint points elsewhere (token cannot steer the destination).