fix: validate universe domain input to prevent SSRF credential leak

[adilburaksen]

Summary

The universe input is interpolated directly into the Cloud Functions API endpoint:

cloudfunctions: 'https://cloudfunctions.{universe}/v2',

Setting universe: attacker.com routes all API calls — including Bearer GCP access tokens — to cloudfunctions.attacker.com.

Fix

Validates universe against known-safe patterns before use:

if (!/^([a-z0-9-]+\.)*googleapis\.com$/.test(universe)) {
  throw new Error(`Invalid universe domain "${universe}": ...`);
}

Allows googleapis.com (default) and Trusted Partner Cloud subdomains like us-central1.rep.googleapis.com. Blocks arbitrary hostnames.

Related

Companion PR for upload-cloud-storage: google-github-actions/upload-cloud-storage#404
Same class, same root cause in expandUniverseEndpoints.

[adilburaksen]

Updated this PR based on further review:

• The validation now checks that universe is a well-formed DNS hostname (no scheme, path, port, userinfo, query, or fragment) rather than allowlisting *.googleapis.com. The earlier allowlist would have broken non-googleapis.com Trusted Partner Cloud / Google Distributed Cloud universes — this revision is non-breaking while still blocking the credential-leak vector (e.g. attacker.com# truncating the real host).
• Extracted the check into validateUniverse (src/util.ts) with unit tests in tests/util.test.ts covering injection payloads and legitimate universes. Lint clean.

Companion fix: google-github-actions/upload-cloud-storage#404. Happy to address any review feedback.

[adilburaksen]

Gentle ping on this one (companion to upload-cloud-storage#404, same class). It validates the universe input against the googleapis.com domain pattern before URL construction, so an arbitrary host can't be substituted into the endpoint (which otherwise routes the request — with the access token — to an attacker-controlled host). CLA is signed and it's a small, self-contained change. @verbanicm — would you be able to take a look when you have a moment? Thanks!

[adilburaksen]

@ChrisGe4 @verbanicm — gentle follow-up. This validates the universe input against the googleapis.com domain pattern before the endpoint is constructed, so a crafted universe can no longer redirect the Cloud Functions API request (carrying the GCP access token) to an arbitrary host. Mergeable, green, with added tests; this is the companion to the same fix in upload-cloud-storage #404. Could you take a look when you get a chance? Happy to adjust per your preference.