Incomplete regular expression WORKFORCE_AUDIENCE_PATTERN

[hankei6km]

My repository( (hankei6km/gdrive-act-share ) contains the code that bundles googleapis/google-auth-library-nodejs. And my repositry is enabled CodeQL.

CodeQL has detected that it has not escaped the meta-character.

This string, which is used as a regular expression here, has an unescaped '.' before 'googleapis.com/locations/', so it might match more hosts than expected.

google-auth-library-nodejs/src/auth/baseexternalclient.ts

Lines 61 to 62 in 54cfaaf

	const WORKFORCE_AUDIENCE_PATTERN =
	'//iam.googleapis.com/locations/[^/]+/workforcePools/[^/]+/providers/.+';

Environment details

• OS: Docker Container(mcr.microsoft.com/vscode/devcontainers/typescript-node:16-bullseye)
• Node.js version: v16.14.0
• npm version: 8.3.1
• google-auth-library version: google-auth-library@7.14.0

Steps to reproduce

I checked it in the cloned repository.

I Added //iam.googleapisXcom/locations/global/workforcePools/workloadPools/providers/oidc to this test.

it('should not throw on valid service account impersonation url', () => {

})

https://github.com/hankei6km/test-google-auth-library-nodejs/blob/b5f091b2b304645e7039e6eb778130ad88fb6842/test/test.baseexternalclient.ts#L285-L286

It was not thrown.

https://github.com/hankei6km/test-google-auth-library-nodejs/runs/5672358984?check_suite_focus=true#step:8:820

After fixing it, it was thrown.

const WORKFORCE_AUDIENCE_PATTERN =
  '//iam\\.googleapis\\.com/locations/[^/]+/workforcePools/[^/]+/providers/.+';

https://github.com/hankei6km/test-google-auth-library-nodejs/blob/7fd8372539d77c69552848c1e3e95d76d44a8e30/src/auth/baseexternalclient.ts#L60-L62

[danielbankhead]

Thanks for filing! I've created a PR to resolve.