diff --git a/.nextchanges/cli/login-reject-empty-host.md b/.nextchanges/cli/login-reject-empty-host.md new file mode 100644 index 00000000000..f8d36c6a325 --- /dev/null +++ b/.nextchanges/cli/login-reject-empty-host.md @@ -0,0 +1 @@ +* `databricks auth login` and `databricks auth token` now reject a host that is not a URL with a hostname, such as `/`, `?o=123` or `https://`, instead of falling back to `DATABRICKS_HOST` or failing later. An empty host after "Enter a host" in the login profile picker no longer starts discovery login. ([#7195](https://github.com/databricks/cli/pull/7195)) diff --git a/acceptance/cmd/auth/login/invalid-host/out.test.toml b/acceptance/cmd/auth/login/invalid-host/out.test.toml new file mode 100644 index 00000000000..18b1a88417e --- /dev/null +++ b/acceptance/cmd/auth/login/invalid-host/out.test.toml @@ -0,0 +1 @@ +Cloud = false diff --git a/acceptance/cmd/auth/login/invalid-host/output.txt b/acceptance/cmd/auth/login/invalid-host/output.txt new file mode 100644 index 00000000000..7288b68fc0f --- /dev/null +++ b/acceptance/cmd/auth/login/invalid-host/output.txt @@ -0,0 +1,6 @@ + +>>> musterr [CLI] auth login --host ?o=123 --profile test +Error: invalid host "?o=123" + +>>> musterr [CLI] auth login --host https:// --profile test +Error: invalid host "https://" diff --git a/acceptance/cmd/auth/login/invalid-host/script b/acceptance/cmd/auth/login/invalid-host/script new file mode 100644 index 00000000000..c6a8ce4da47 --- /dev/null +++ b/acceptance/cmd/auth/login/invalid-host/script @@ -0,0 +1,9 @@ +sethome "./home" + +# A host that is empty without its query params is rejected before login +# can fall back to discovery or DATABRICKS_HOST. +trace musterr $CLI auth login --host '?o=123' --profile test + +# A host without a hostname is rejected instead of being read as a host +# named "https". +trace musterr $CLI auth login --host 'https://' --profile test diff --git a/acceptance/cmd/auth/login/invalid-host/test.toml b/acceptance/cmd/auth/login/invalid-host/test.toml new file mode 100644 index 00000000000..36c0e7e237b --- /dev/null +++ b/acceptance/cmd/auth/login/invalid-host/test.toml @@ -0,0 +1,3 @@ +Ignore = [ + "home" +] diff --git a/acceptance/cmd/auth/token/invalid-host/out.test.toml b/acceptance/cmd/auth/token/invalid-host/out.test.toml new file mode 100644 index 00000000000..18b1a88417e --- /dev/null +++ b/acceptance/cmd/auth/token/invalid-host/out.test.toml @@ -0,0 +1 @@ +Cloud = false diff --git a/acceptance/cmd/auth/token/invalid-host/output.txt b/acceptance/cmd/auth/token/invalid-host/output.txt new file mode 100644 index 00000000000..d0d54632d4b --- /dev/null +++ b/acceptance/cmd/auth/token/invalid-host/output.txt @@ -0,0 +1,6 @@ + +>>> musterr [CLI] auth token --host ?o=123 +Error: invalid host "?o=123" + +>>> musterr [CLI] auth token --host https:// +Error: invalid host "https://" diff --git a/acceptance/cmd/auth/token/invalid-host/script b/acceptance/cmd/auth/token/invalid-host/script new file mode 100644 index 00000000000..1a3c46bd114 --- /dev/null +++ b/acceptance/cmd/auth/token/invalid-host/script @@ -0,0 +1,13 @@ +sethome "./home" + +unset DATABRICKS_HOST +unset DATABRICKS_TOKEN +unset DATABRICKS_CONFIG_PROFILE + +# A host that is empty without its query params is rejected instead of +# falling back to DATABRICKS_HOST. +trace musterr $CLI auth token --host '?o=123' + +# A host without a hostname is rejected instead of being read as a host +# named "https". +trace musterr $CLI auth token --host 'https://' diff --git a/acceptance/cmd/auth/token/invalid-host/test.toml b/acceptance/cmd/auth/token/invalid-host/test.toml new file mode 100644 index 00000000000..36c0e7e237b --- /dev/null +++ b/acceptance/cmd/auth/token/invalid-host/test.toml @@ -0,0 +1,3 @@ +Ignore = [ + "home" +] diff --git a/cmd/auth/auth.go b/cmd/auth/auth.go index 6bbee3730b3..0bcfb9635c8 100644 --- a/cmd/auth/auth.go +++ b/cmd/auth/auth.go @@ -4,6 +4,7 @@ import ( "context" "errors" "fmt" + "strings" "github.com/databricks/cli/libs/auth" "github.com/databricks/cli/libs/cmdio" @@ -51,9 +52,18 @@ func promptForHost(ctx context.Context) (string, error) { // long "label + value" line that wraps causes each keystroke to leave a // stale render on screen instead of overwriting the previous one. cmdio.LogString(ctx, "Example: https://.cloud.databricks.com") - return cmdio.RunPrompt(ctx, cmdio.PromptOptions{ + result, err := cmdio.RunPrompt(ctx, cmdio.PromptOptions{ Label: "Databricks host", + Validate: func(input string) error { + if strings.TrimSpace(input) == "" { + return errors.New("host is required") + } + // Reject hosts that setHost would reject after the prompt, + // e.g. "/" or "?o=123", while the user can still edit them. + return validateLoginHost(input) + }, }) + return strings.TrimSpace(result), err } func promptForAccountID(ctx context.Context) (string, error) { diff --git a/cmd/auth/auth_test.go b/cmd/auth/auth_test.go index 9dbf04fc664..10cb67409b9 100644 --- a/cmd/auth/auth_test.go +++ b/cmd/auth/auth_test.go @@ -3,10 +3,12 @@ package auth import ( "os" "path/filepath" + "strings" "testing" "github.com/databricks/cli/cmd/root" "github.com/databricks/cli/libs/cmdctx" + "github.com/databricks/cli/libs/cmdio/cmdiotest/termtest" "github.com/databricks/cli/libs/databrickscfg/profile" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" @@ -141,3 +143,27 @@ func TestProfileHostCompatibleViaCobra(t *testing.T) { assert.NotContains(t, err.Error(), "conflicts with --host") } } + +func TestPromptForHostRejectsEmptyHost(t *testing.T) { + tm := termtest.Run(t, promptForHost) + tm.WaitFor("Databricks host") + tm.Type(termtest.KeyEnter) + tm.Golden("01-empty") + tm.Type(" " + termtest.KeyEnter) + tm.Golden("02-spaces") + tm.Type("https://workspace.test " + termtest.KeyEnter) + host, err := tm.Result() + require.NoError(t, err) + assert.Equal(t, "https://workspace.test", host) +} + +func TestPromptForHostRejectsHostEmptyAfterNormalization(t *testing.T) { + tm := termtest.Run(t, promptForHost) + tm.WaitFor("Databricks host") + tm.Type("?o=123" + termtest.KeyEnter) + tm.Golden("01-query-params") + tm.Type(strings.Repeat(termtest.KeyBackspace, len("?o=123")) + "https://workspace.test/?o=123" + termtest.KeyEnter) + host, err := tm.Result() + require.NoError(t, err) + assert.Equal(t, "https://workspace.test/?o=123", host) +} diff --git a/cmd/auth/login.go b/cmd/auth/login.go index abbfeeeb81b..146ff689400 100644 --- a/cmd/auth/login.go +++ b/cmd/auth/login.go @@ -4,6 +4,7 @@ import ( "context" "errors" "fmt" + "net/url" "runtime" "slices" "strconv" @@ -232,6 +233,14 @@ a new profile is created. } } + // setHost normalizes the host only after the keyring probe and the + // profile name prompt, so reject an invalid host before them. + if authArguments.Host != "" { + if err := validateLoginHost(authArguments.Host); err != nil { + return err + } + } + if useDeviceCode { if err := validateDeviceCodeLogin(ctx, cmd); err != nil { return err @@ -286,11 +295,6 @@ a new profile is created. if err != nil { return err } - // Fail here rather than prompting for the host again after - // the profile name. - if useDeviceCode && host == "" { - return errDeviceCodeNeedsHost - } authArguments.Host = host case profilePickerCreateNew: // Reject the names of existing profiles, including those the @@ -310,13 +314,8 @@ a new profile is created. // only populated by setHostAndAccountId further down, which runs after // the profile-name prompt. if skipWorkspace && profileName == "" && authArguments.Host != "" && authArguments.AccountID == "" { - params := auth.ExtractHostQueryParams(authArguments.Host) - authArguments.Host = params.Host - if authArguments.AccountID == "" { - authArguments.AccountID = params.AccountID - } - if authArguments.WorkspaceID == "" { - authArguments.WorkspaceID = params.WorkspaceID + if err := normalizeLoginHost(authArguments); err != nil { + return err } runHostDiscovery(ctx, authArguments) } @@ -379,15 +378,8 @@ a new profile is created. // Check the host once it is resolved, before setAccountID prompts for // an account ID for account and unified hosts. A workspace without // device code login enabled is rejected later by deviceCodeLogin. - if useDeviceCode { - // The host prompt accepts an empty answer. Without this check, - // login would resolve the host from DATABRICKS_HOST instead. - if authArguments.Host == "" { - return errDeviceCodeNeedsHost - } - if !isDeviceCodeSupportedForHost(authArguments.Host, authArguments.DiscoveryURL) { - return errDeviceCodeWorkspaceOnly - } + if useDeviceCode && !isDeviceCodeSupportedForHost(authArguments.Host, authArguments.DiscoveryURL) { + return errDeviceCodeWorkspaceOnly } err = setAccountID(ctx, existingProfile, authArguments) if err != nil { @@ -577,6 +569,52 @@ func setHostAndAccountId(ctx context.Context, existingProfile *profile.Profile, return setAccountID(ctx, existingProfile, authArguments) } +var errInvalidHost = errors.New("invalid host") + +// normalizeLoginHost strips the trailing slash and the query params from the +// host and moves the workspace and account ID query params into WorkspaceID and +// AccountID unless they are set. +// It fails if the host is not a URL with a hostname, e.g. for "/", "?o=123", +// "https://" or "https://my workspace.test", because login would then use discovery +// or DATABRICKS_HOST, connect to a host named "https", or fail later. +func normalizeLoginHost(authArguments *auth.AuthArguments) error { + rawHost := authArguments.Host + authArguments.Host = strings.TrimSuffix(strings.TrimSpace(authArguments.Host), "/") + + // Extract query parameters from the host URL (?o=workspace_id, ?a=account_id). + // URL params from explicit --host override stale profile values. + params := auth.ExtractHostQueryParams(authArguments.Host) + authArguments.Host = params.Host + if !hasHostname(authArguments.Host) { + return fmt.Errorf("%w %q", errInvalidHost, rawHost) + } + if authArguments.WorkspaceID == "" { + authArguments.WorkspaceID = params.WorkspaceID + } + if authArguments.AccountID == "" { + authArguments.AccountID = params.AccountID + } + return nil +} + +// validateLoginHost returns the error normalizeLoginHost returns for host. +func validateLoginHost(host string) error { + return normalizeLoginHost(&auth.AuthArguments{Host: host}) +} + +// hasHostname reports whether host, with or without a scheme, is a URL with a +// hostname. +func hasHostname(host string) bool { + // url.Parse can't read a host without a scheme, e.g. "localhost:8080", + // so check it as an https host. + lower := strings.ToLower(host) + if !strings.HasPrefix(lower, "https:") && !strings.HasPrefix(lower, "http:") { + host = "https://" + host + } + u, err := url.Parse(host) + return err == nil && u.Hostname() != "" +} + // Sets the host in the persistentAuth object based on the provided arguments and flags. // Follows the following precedence: // 1. [HOST] (first positional argument) or --host flag. Error if both are specified. @@ -608,17 +646,8 @@ func setHost(ctx context.Context, existingProfile *profile.Profile, authArgument } } - authArguments.Host = strings.TrimSuffix(authArguments.Host, "/") - - // Extract query parameters from the host URL (?o=workspace_id, ?a=account_id). - // URL params from explicit --host override stale profile values. - params := auth.ExtractHostQueryParams(authArguments.Host) - authArguments.Host = params.Host - if authArguments.WorkspaceID == "" { - authArguments.WorkspaceID = params.WorkspaceID - } - if authArguments.AccountID == "" { - authArguments.AccountID = params.AccountID + if err := normalizeLoginHost(authArguments); err != nil { + return err } // Inherit workspace_id from the existing profile AFTER URL param extraction. diff --git a/cmd/auth/login_device_code.go b/cmd/auth/login_device_code.go index e960c6dd2b9..4bbb1b21058 100644 --- a/cmd/auth/login_device_code.go +++ b/cmd/auth/login_device_code.go @@ -27,10 +27,7 @@ var deviceCodeIncompatibleFlags = []string{ "skip-workspace", } -var ( - errDeviceCodeNeedsHost = errors.New("--use-device-code requires a workspace host. Pass it as an argument or with --host") - errDeviceCodeWorkspaceOnly = errors.New("--use-device-code is only supported for workspace hosts") -) +var errDeviceCodeWorkspaceOnly = errors.New("--use-device-code is only supported for workspace hosts") // isDeviceCodeSupportedForHost reports whether host is a workspace host. A // unified host is only recognized by its account-scoped discoveryURL, so with diff --git a/cmd/auth/login_device_code_test.go b/cmd/auth/login_device_code_test.go index 5fbb18c1a18..84c11f599a7 100644 --- a/cmd/auth/login_device_code_test.go +++ b/cmd/auth/login_device_code_test.go @@ -221,8 +221,10 @@ func startLogin(t *testing.T, config string, args ...string) *termtest.Term[stru t.Setenv("DATABRICKS_AUTH_STORAGE", "plaintext") return termtest.Run(t, func(ctx context.Context) (struct{}, error) { - cmd := newLoginCommand(&auth.AuthArguments{}) + authArguments := &auth.AuthArguments{} + cmd := newLoginCommand(authArguments) cmd.Flags().String("profile", "", "") + cmd.Flags().StringVar(&authArguments.Host, "host", "", "") cmd.SetContext(ctx) // Cobra reads os.Args when the args are nil. cmd.SetArgs(append([]string{}, args...)) @@ -243,8 +245,10 @@ func TestLoginDeviceCodeNewProfilePromptsForHost(t *testing.T) { tm := startDeviceCodeLogin(t, "", "--profile", "newprof") tm.WaitFor("Databricks host") tm.Type(termtest.KeyEnter) + tm.WaitFor(">> host is required") + tm.Type(termtest.KeyCtrlC) _, err := tm.Result() - assert.ErrorIs(t, err, errDeviceCodeNeedsHost) + assert.EqualError(t, err, "^C") } func TestLoginDeviceCodePickerEmptyHost(t *testing.T) { @@ -259,8 +263,10 @@ func TestLoginDeviceCodePickerEmptyHost(t *testing.T) { tm.Type(termtest.KeyDown + termtest.KeyEnter) tm.WaitFor("Databricks host") tm.Type(termtest.KeyEnter) + tm.WaitFor(">> host is required") + tm.Type(termtest.KeyCtrlC) _, err := tm.Result() - assert.ErrorIs(t, err, errDeviceCodeNeedsHost) + assert.EqualError(t, err, "^C") } func TestLoginDeviceCodeCreateNewProfileRejectsHiddenProfileName(t *testing.T) { @@ -286,6 +292,23 @@ account_id = acct-123 assert.EqualError(t, err, "^C") } +func TestLoginDeviceCodeHostEmptyAfterNormalization(t *testing.T) { + tests := []struct { + name string + host string + }{ + {name: "slash", host: "/"}, + {name: "query params only", host: "?o=123"}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + tm := startDeviceCodeLogin(t, "", "--profile", "newprof", "--host", tt.host) + _, err := tm.Result() + assert.ErrorIs(t, err, errInvalidHost) + }) + } +} + func TestMatchDeviceCodeProfiles(t *testing.T) { tests := []struct { name string diff --git a/cmd/auth/login_test.go b/cmd/auth/login_test.go index 3bbf7249e45..14b364835d7 100644 --- a/cmd/auth/login_test.go +++ b/cmd/auth/login_test.go @@ -166,15 +166,15 @@ func TestSetHost(t *testing.T) { profile2 := loadTestProfile(t, ctx, "profile-2") // Test error when both flag and argument are provided - authArguments.Host = "val from --host" - err := setHostAndAccountId(ctx, profile1, &authArguments, []string{"val from [HOST]"}) + authArguments.Host = "https://www.host-from-flag.test" + err := setHostAndAccountId(ctx, profile1, &authArguments, []string{"https://www.host-from-arg.test"}) assert.EqualError(t, err, "please only provide a host as an argument or a flag, not both") // Test setting host from flag - authArguments.Host = "val from --host" + authArguments.Host = "https://www.host-from-flag.test" err = setHostAndAccountId(ctx, profile1, &authArguments, []string{}) assert.NoError(t, err) - assert.Equal(t, "val from --host", authArguments.Host) + assert.Equal(t, "https://www.host-from-flag.test", authArguments.Host) // Test setting host from flag with trailing slash is stripped authArguments.Host = "https://www.host1.test/" @@ -184,9 +184,9 @@ func TestSetHost(t *testing.T) { // Test setting host from argument authArguments.Host = "" - err = setHostAndAccountId(ctx, profile1, &authArguments, []string{"val from [HOST]"}) + err = setHostAndAccountId(ctx, profile1, &authArguments, []string{"https://www.host-from-arg.test"}) assert.NoError(t, err) - assert.Equal(t, "val from [HOST]", authArguments.Host) + assert.Equal(t, "https://www.host-from-arg.test", authArguments.Host) // Test setting host from argument with trailing slash is stripped authArguments.Host = "" @@ -206,6 +206,59 @@ func TestSetHost(t *testing.T) { assert.NoError(t, err) assert.Equal(t, "https://www.host2.test", authArguments.Host) + // Test host that is empty after normalization from flag + authArguments.Host = "?o=123" + err = setHostAndAccountId(ctx, profile1, &authArguments, []string{}) + assert.ErrorIs(t, err, errInvalidHost) + + // Test host that is empty after normalization from argument + authArguments.Host = "" + err = setHostAndAccountId(ctx, profile1, &authArguments, []string{"/"}) + assert.ErrorIs(t, err, errInvalidHost) + + // Test host that is empty after normalization from profile + authArguments.Host = "" + err = setHostAndAccountId(ctx, &profile.Profile{Host: "/"}, &authArguments, []string{}) + assert.ErrorIs(t, err, errInvalidHost) + + // Test host of only spaces from flag + authArguments.Host = " " + err = setHostAndAccountId(ctx, profile1, &authArguments, []string{}) + assert.EqualError(t, err, `invalid host " "`) + + // Test host with a scheme but no hostname from flag + authArguments.Host = "https://" + err = setHostAndAccountId(ctx, profile1, &authArguments, []string{}) + assert.EqualError(t, err, `invalid host "https://"`) + + // Test host with a scheme and query params but no hostname from flag + authArguments.Host = "https://?o=123" + err = setHostAndAccountId(ctx, profile1, &authArguments, []string{}) + assert.EqualError(t, err, `invalid host "https://?o=123"`) + + // Test host that is not a URL from flag + authArguments.Host = "my workspace.test" + err = setHostAndAccountId(ctx, profile1, &authArguments, []string{}) + assert.EqualError(t, err, `invalid host "my workspace.test"`) + + // Test host with a scheme that is not a URL from flag + authArguments.Host = "https://my workspace.test" + err = setHostAndAccountId(ctx, profile1, &authArguments, []string{}) + assert.EqualError(t, err, `invalid host "https://my workspace.test"`) + + // Test host:port without a scheme from flag + authArguments = auth.AuthArguments{Host: "www.host1.test:8080"} + err = setHostAndAccountId(ctx, profile1, &authArguments, []string{}) + assert.NoError(t, err) + assert.Equal(t, "www.host1.test:8080", authArguments.Host) + + // Test spaces around the host are trimmed before the query params are extracted + authArguments = auth.AuthArguments{Host: " https://www.host1.test/?o=123 "} + err = setHostAndAccountId(ctx, profile1, &authArguments, []string{}) + assert.NoError(t, err) + assert.Equal(t, "https://www.host1.test", authArguments.Host) + assert.Equal(t, "123", authArguments.WorkspaceID) + // Test host is not set. Should prompt. authArguments.Host = "" err = setHostAndAccountId(ctx, nil, &authArguments, []string{}) @@ -791,11 +844,7 @@ func TestSkipWorkspaceProfileNameUsesDiscoveredAccountID(t *testing.T) { args := &auth.AuthArguments{Host: server.URL} // Mirrors the pre-naming block in newLoginCommand's RunE for --skip-workspace. - params := auth.ExtractHostQueryParams(args.Host) - args.Host = params.Host - if args.AccountID == "" { - args.AccountID = params.AccountID - } + require.NoError(t, normalizeLoginHost(args)) runHostDiscovery(ctx, args) assert.Equal(t, "abc-123", args.AccountID) @@ -1463,6 +1512,42 @@ func TestLoginRejectsPositionalArgWithProfileFlag(t *testing.T) { assert.ErrorContains(t, err, `argument "https://example.com" cannot be combined with --host or --profile`) } +func TestLoginSkipWorkspaceRejectsInvalidHost(t *testing.T) { + home := t.TempDir() + t.Setenv("HOME", home) + t.Setenv("USERPROFILE", home) + t.Setenv("DATABRICKS_CONFIG_FILE", writeTempConfig(t, "")) + t.Setenv("DATABRICKS_AUTH_STORAGE", "plaintext") + + ctx := cmdio.MockDiscard(t.Context()) + authArgs := &auth.AuthArguments{Host: "?a=123"} + cmd := newLoginCommand(authArgs) + cmd.Flags().String("profile", "", "") + cmd.SetContext(ctx) + cmd.SetArgs([]string{"--skip-workspace"}) + err := cmd.Execute() + assert.EqualError(t, err, `invalid host "?a=123"`) +} + +func TestLoginRejectsInvalidHostBeforeProfileNamePrompt(t *testing.T) { + tests := []struct { + name string + args []string + }{ + {name: "slash", args: []string{"--host", "/"}}, + {name: "no hostname", args: []string{"--host", "https://"}}, + {name: "positional arg without hostname", args: []string{"https://?o=123"}}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + // Without --profile, login would otherwise wait at the profile name prompt. + tm := startLogin(t, "", tt.args...) + _, err := tm.Result() + assert.ErrorIs(t, err, errInvalidHost) + }) + } +} + func TestPromptForProfileRejectsTakenName(t *testing.T) { tm := termtest.Run(t, func(ctx context.Context) (string, error) { return promptForProfile(ctx, "DEFAULT", []string{"DEFAULT", "taken"}) diff --git a/cmd/auth/testdata/TestPromptForHostRejectsEmptyHost/01-empty.golden b/cmd/auth/testdata/TestPromptForHostRejectsEmptyHost/01-empty.golden new file mode 100644 index 00000000000..01918873e19 --- /dev/null +++ b/cmd/auth/testdata/TestPromptForHostRejectsEmptyHost/01-empty.golden @@ -0,0 +1,3 @@ +Example: https://.cloud.databricks.com +✗ Databricks host: █ +>> host is required diff --git a/cmd/auth/testdata/TestPromptForHostRejectsEmptyHost/02-spaces.golden b/cmd/auth/testdata/TestPromptForHostRejectsEmptyHost/02-spaces.golden new file mode 100644 index 00000000000..7c5f1e4da33 --- /dev/null +++ b/cmd/auth/testdata/TestPromptForHostRejectsEmptyHost/02-spaces.golden @@ -0,0 +1,3 @@ +Example: https://.cloud.databricks.com +✗ Databricks host: █ +>> host is required diff --git a/cmd/auth/testdata/TestPromptForHostRejectsHostEmptyAfterNormalization/01-query-params.golden b/cmd/auth/testdata/TestPromptForHostRejectsHostEmptyAfterNormalization/01-query-params.golden new file mode 100644 index 00000000000..be92e1393e7 --- /dev/null +++ b/cmd/auth/testdata/TestPromptForHostRejectsHostEmptyAfterNormalization/01-query-params.golden @@ -0,0 +1,3 @@ +Example: https://.cloud.databricks.com +✗ Databricks host: ?o=123█ +>> invalid host "?o=123"