Bug Fixes

Tenant token URL injection — XsuaaAuthProvider previously used str.replace(identityzone, tenant_subdomain) to derive the per-tenant OAuth2 token URL. If the identityzone value also appeared in the URL path (e.g. https://provider-zone.auth.region/provider-zone/token), it would be replaced there too, producing a malformed or attacker-controlled URL. The fix introduces _derive_tenant_token_url in sap_cloud_sdk.core._tenant, which uses urllib.parse to replace only the leading DNS label of the hostname when it matches identityzone. All other URL components (path, query, port, fragment) are preserved verbatim.

Navigation Menu

No results found