[DO NOT REVIEW] [Stephanie] Fix for Server Challenge Token Security Incident by stefong99

[ankushbindlish2]

Description

Mandatory Checklist

• Please choose the target release of Azure PowerShell. (⚠️Target release is a different concept from API readiness. Please click below links for details.)

  • General release
  • Public preview
  • Private preview
  • Engineering build
  • No need for a release

• Check this box to confirm: I have read the Submitting Changes section of CONTRIBUTING.md and reviewed the following information:

• SHOULD update ChangeLog.md file(s) appropriately
  • Update src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md.
    • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header in the past tense.
  • Should not change ChangeLog.md if no new release is required, such as fixing test case only.
• SHOULD regenerate markdown help files if there is cmdlet API change. Instruction
• SHOULD have proper test coverage for changes in pull request.
• SHOULD NOT adjust version of module manually in pull request

[azure-client-tools-bot-prd]

Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status.

[Copilot]

Pull Request Overview

This PR strengthens the security of server-managed identity token acquisition by normalizing and validating the secret file path, handling missing environment variables, and updating related resources and release notes.

• Introduces IsSecretFilePathValid to normalize and validate the token file path and replaces inline validation
• Adds handling and a new resource string for missing ProgramData environment variable
• Renames header parsing variable, updates StorageSyncResources.resx, and records the fix in ChangeLog.md

Reviewed Changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated 1 comment.

File	Description
src/StorageSync/StorageSync/Properties/StorageSyncResources.resx	Removed obsolete XML entry and added AgentMI_ProgramDataNotFoundError resource
src/StorageSync/StorageSync/Interop/ManagedIdentity/ServerManagedIdentityUtils.cs	Refactored challenge token parsing into IsSecretFilePathValid and updated naming
src/StorageSync/StorageSync/ChangeLog.md	Added a note for the security bug fix in token acquisition

Files not reviewed (1)

• src/StorageSync/StorageSync/Properties/StorageSyncResources.Designer.cs: Language not supported

Comments suppressed due to low confidence (3)

src/StorageSync/StorageSync/Interop/ManagedIdentity/ServerManagedIdentityUtils.cs:275

• [nitpick] The variable name 'wwwHeader' is ambiguous; consider renaming it to something more descriptive like 'challengeHeaderValue'.

                    var wwwHeader = authenticateHeaderValues.FirstOrDefault();

src/StorageSync/StorageSync/Interop/ManagedIdentity/ServerManagedIdentityUtils.cs:342

• Provide a description for the 'secretFilePath' parameter in the XML doc to explain its purpose and expected format.

        /// <param name="secretFilePath"></param>

src/StorageSync/StorageSync/Interop/ManagedIdentity/ServerManagedIdentityUtils.cs:344

• Add unit tests for 'IsSecretFilePathValid' to cover valid token paths, paths outside the allowed folder, and missing 'ProgramData' or 'SystemDrive' scenarios.

        private static bool IsSecretFilePathValid(string secretFilePath)

[Copilot]

The error message is missing a period at the end to match the style of other resource strings.

Suggested change

	<value>GetEnvironmentVariable failed to find 'ProgramData'</value>
	<value>GetEnvironmentVariable failed to find 'ProgramData'.</value>

[YanaXu]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 3 pipeline(s).