Harden the HTTPS authority host check to explicitly check for https and disallow everything else

[ahsonkhan]

The Java check needs to be hardened. Unlike the other language SDKs, which check that the scheme string is exactly HTTPS and fails otherwise, the Java check only confirms that it is "not HTTP" (and assumes anything else is "HTTPS"). That, along with the fact that the setter doesn't do any checking, there could be a way for a malformed authority host url to get through.

Comparing to other languages, this check:

azure-sdk-for-java/sdk/core/azure-core/src/main/java/com/azure/core/http/policy/BearerTokenAuthenticationPolicy.java

Lines 93 to 95 in 0fbfd34

	if ("http".equals(context.getHttpRequest().getUrl().getProtocol())) {
	return Mono.error(new RuntimeException("token credentials require a URL using the HTTPS protocol scheme"));
	}

Should be something like the following (unless we have other non-HTTP supported schemes beyond HTTPS in Java): if (!context.getHttpRequest().getUrl().getProtocol().equals("https")

Introduced in this PR (the intent of which I gather is to only allow HTTPS): #6543

cc @joshfree, @billwert

[Vijay-948]

Issue #37236 - Hardening the HTTPS Authority Host Check

Hello,

The issue raised in GitHub issue #37236 is about improving the security of the HTTPS authority host check in the Java SDK for Azure. The problem is that the current implementation checks if the protocol is "not http" and assumes that anything else is "https."
Try this one
if (!context.getHttpRequest().getUrl().getProtocol().equalsIgnoreCase("https")) {
return Mono.error(new RuntimeException("token credentials require a URL using the HTTPS protocol scheme"));
}

[alzimmermsft]

Thanks for filing this @ahsonkhan!

@Vijay-948, if you want to create a PR with that change, we'd be more than happy to review it.

[Vijay-948]

I'm sorry to hear that I'm facing difficulties with creating a pull request (PR) due to file path length issues. It seems like this problem is occurring at the file system level(file name is too long).