fix: Fixing code scanning alert on AAD issuer validation

Andrew Omondi · Andrew Omondi · commit 523a5dc26edf · 2024-08-19T10:24:47.000+03:00
diff --git a/src/Microsoft.Graph.Core/Extensions/ITokenValidableExtension.cs b/src/Microsoft.Graph.Core/Extensions/ITokenValidableExtension.cs
@@ -7,6 +7,7 @@ namespace Microsoft.Graph
     using Microsoft.IdentityModel.Protocols.OpenIdConnect;
     using Microsoft.IdentityModel.Tokens;
     using Microsoft.IdentityModel.Protocols;
+    using Microsoft.IdentityModel.Validators;
     using System;
     using System.Collections.Generic;
     using System.Linq;
@@ -65,7 +66,7 @@ private static bool IsTokenValid(string token, JwtSecurityTokenHandler handler,
         {
             try
             {
-                handler.ValidateToken(token, new TokenValidationParameters
+                var tokenValidationParameters = new TokenValidationParameters
                 {
                     ValidateIssuer = true,
                     ValidateAudience = true,
@@ -74,7 +75,9 @@ private static bool IsTokenValid(string token, JwtSecurityTokenHandler handler,
                     ValidIssuers = issuersToValidate,
                     ValidAudiences = appIds,
                     IssuerSigningKeys = openIdConfig.SigningKeys
-                }, out _);
+                };
+                tokenValidationParameters.EnableAadSigningKeyIssuerValidation();
+                handler.ValidateToken(token,  tokenValidationParameters, out _);
             }
             catch
             {
diff --git a/src/Microsoft.Graph.Core/Microsoft.Graph.Core.csproj b/src/Microsoft.Graph.Core/Microsoft.Graph.Core.csproj
@@ -63,14 +63,15 @@
   </ItemGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="8.0.1" />
+    <PackageReference Include="Microsoft.IdentityModel.Validators" Version="8.0.1" />
     <PackageReference Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="All" />
     <PackageReference Include="Microsoft.Kiota.Abstractions" Version="1.11.3" />
     <PackageReference Include="Microsoft.Kiota.Authentication.Azure" Version="1.11.3" />
     <PackageReference Include="Microsoft.Kiota.Serialization.Json" Version="1.11.3" />
-    <PackageReference Include="Microsoft.Kiota.Serialization.Text" Version="1.11.2" />
-    <PackageReference Include="Microsoft.Kiota.Serialization.Form" Version="1.11.2" />
+    <PackageReference Include="Microsoft.Kiota.Serialization.Text" Version="1.11.3" />
+    <PackageReference Include="Microsoft.Kiota.Serialization.Form" Version="1.11.3" />
     <PackageReference Include="Microsoft.Kiota.Http.HttpClientLibrary" Version="1.11.3" />
-    <PackageReference Include="Microsoft.Kiota.Serialization.Multipart" Version="1.11.2" />
+    <PackageReference Include="Microsoft.Kiota.Serialization.Multipart" Version="1.11.3" />
   </ItemGroup>
   <ItemGroup Condition=" '$(TargetFramework)' == 'net462' ">
     <PackageReference Include="System.Net.Http.WinHttpHandler" Version="[6.0,9.0)" />

Original file line number	Diff line number	Diff line change
`@@ -7,6 +7,7 @@ namespace Microsoft.Graph`
`7`	`7`	`using Microsoft.IdentityModel.Protocols.OpenIdConnect;`
`8`	`8`	`using Microsoft.IdentityModel.Tokens;`
`9`	`9`	`using Microsoft.IdentityModel.Protocols;`
	`10`	`+ using Microsoft.IdentityModel.Validators;`
`10`	`11`	`using System;`
`11`	`12`	`using System.Collections.Generic;`
`12`	`13`	`using System.Linq;`
`@@ -65,7 +66,7 @@ private static bool IsTokenValid(string token, JwtSecurityTokenHandler handler,`
`65`	`66`	`{`
`66`	`67`	`try`
`67`	`68`	`{`
`68`		`- handler.ValidateToken(token, new TokenValidationParameters`
	`69`	`+ var tokenValidationParameters = new TokenValidationParameters`
`69`	`70`	`{`
`70`	`71`	`ValidateIssuer = true,`
`71`	`72`	`ValidateAudience = true,`
`@@ -74,7 +75,9 @@ private static bool IsTokenValid(string token, JwtSecurityTokenHandler handler,`
`74`	`75`	`ValidIssuers = issuersToValidate,`
`75`	`76`	`ValidAudiences = appIds,`
`76`	`77`	`IssuerSigningKeys = openIdConfig.SigningKeys`
`77`		`- }, out _);`
	`78`	`+ };`
	`79`	`+ tokenValidationParameters.EnableAadSigningKeyIssuerValidation();`
	`80`	`+ handler.ValidateToken(token, tokenValidationParameters, out _);`
`78`	`81`	`}`
`79`	`82`	`catch`
`80`	`83`	`{`