Skip to content

Commit

Permalink
docs: add warning against accepting untrusted credentials (#8043)
Browse files Browse the repository at this point in the history 
PiperOrigin-RevId: 719330114
Source-Link: googleapis/googleapis@9e0f143
Source-Link: googleapis/googleapis-gen@9612bdf
Copy-Tag: eyJwIjoiT3NDb25maWcvLk93bEJvdC55YW1sIiwiaCI6Ijk2MTJiZGY4NmNkYjFhODk0ODU5ODA2ZjMzOTU4MjlmMWNiYTRmMWMifQ==
Copy-Tag: eyJwIjoiT3NMb2dpbi8uT3dsQm90LnlhbWwiLCJoIjoiOTYxMmJkZjg2Y2RiMWE4OTQ4NTk4MDZmMzM5NTgyOWYxY2JhNGYxYyJ9
Copy-Tag: eyJwIjoiUGFyYWxsZWxzdG9yZS8uT3dsQm90LnlhbWwiLCJoIjoiOTYxMmJkZjg2Y2RiMWE4OTQ4NTk4MDZmMzM5NTgyOWYxY2JhNGYxYyJ9
Copy-Tag: eyJwIjoiUGFyYW1ldGVyTWFuYWdlci8uT3dsQm90LnlhbWwiLCJoIjoiOTYxMmJkZjg2Y2RiMWE4OTQ4NTk4MDZmMzM5NTgyOWYxY2JhNGYxYyJ9
Copy-Tag: eyJwIjoiUG9saWN5U2ltdWxhdG9yLy5Pd2xCb3QueWFtbCIsImgiOiI5NjEyYmRmODZjZGIxYTg5NDg1OTgwNmYzMzk1ODI5ZjFjYmE0ZjFjIn0=
Copy-Tag: eyJwIjoiUG9saWN5VHJvdWJsZXNob290ZXIvLk93bEJvdC55YW1sIiwiaCI6Ijk2MTJiZGY4NmNkYjFhODk0ODU5ODA2ZjMzOTU4MjlmMWNiYTRmMWMifQ==
Copy-Tag: eyJwIjoiUG9saWN5VHJvdWJsZXNob290ZXJJYW0vLk93bEJvdC55YW1sIiwiaCI6Ijk2MTJiZGY4NmNkYjFhODk0ODU5ODA2ZjMzOTU4MjlmMWNiYTRmMWMifQ==
Copy-Tag: eyJwIjoiUHJpdmF0ZUNhdGFsb2cvLk93bEJvdC55YW1sIiwiaCI6Ijk2MTJiZGY4NmNkYjFhODk0ODU5ODA2ZjMzOTU4MjlmMWNiYTRmMWMifQ==
Copy-Tag: eyJwIjoiUHJpdmlsZWdlZEFjY2Vzc01hbmFnZXIvLk93bEJvdC55YW1sIiwiaCI6Ijk2MTJiZGY4NmNkYjFhODk0ODU5ODA2ZjMzOTU4MjlmMWNiYTRmMWMifQ==
Copy-Tag: eyJwIjoiUHJvZmlsZXIvLk93bEJvdC55YW1sIiwiaCI6Ijk2MTJiZGY4NmNkYjFhODk0ODU5ODA2ZjMzOTU4MjlmMWNiYTRmMWMifQ==
Copy-Tag: eyJwIjoiUHViU3ViLy5Pd2xCb3QueWFtbCIsImgiOiI5NjEyYmRmODZjZGIxYTg5NDg1OTgwNmYzMzk1ODI5ZjFjYmE0ZjFjIn0=
Copy-Tag: eyJwIjoiUXVvdGFzLy5Pd2xCb3QueWFtbCIsImgiOiI5NjEyYmRmODZjZGIxYTg5NDg1OTgwNmYzMzk1ODI5ZjFjYmE0ZjFjIn0=
Copy-Tag: eyJwIjoiUmFwaWRNaWdyYXRpb25Bc3Nlc3NtZW50Ly5Pd2xCb3QueWFtbCIsImgiOiI5NjEyYmRmODZjZGIxYTg5NDg1OTgwNmYzMzk1ODI5ZjFjYmE0ZjFjIn0=
Copy-Tag: eyJwIjoiUmVjYXB0Y2hhRW50ZXJwcmlzZS8uT3dsQm90LnlhbWwiLCJoIjoiOTYxMmJkZjg2Y2RiMWE4OTQ4NTk4MDZmMzM5NTgyOWYxY2JhNGYxYyJ9
Copy-Tag: eyJwIjoiUmVjb21tZW5kYXRpb25FbmdpbmUvLk93bEJvdC55YW1sIiwiaCI6Ijk2MTJiZGY4NmNkYjFhODk0ODU5ODA2ZjMzOTU4MjlmMWNiYTRmMWMifQ==
Copy-Tag: eyJwIjoiUmVjb21tZW5kZXIvLk93bEJvdC55YW1sIiwiaCI6Ijk2MTJiZGY4NmNkYjFhODk0ODU5ODA2ZjMzOTU4MjlmMWNiYTRmMWMifQ==
Copy-Tag: eyJwIjoiUmVkaXMvLk93bEJvdC55YW1sIiwiaCI6Ijk2MTJiZGY4NmNkYjFhODk0ODU5ODA2ZjMzOTU4MjlmMWNiYTRmMWMifQ==
Copy-Tag: eyJwIjoiUmVkaXNDbHVzdGVyLy5Pd2xCb3QueWFtbCIsImgiOiI5NjEyYmRmODZjZGIxYTg5NDg1OTgwNmYzMzk1ODI5ZjFjYmE0ZjFjIn0=
Copy-Tag: eyJwIjoiUmVzb3VyY2VNYW5hZ2VyLy5Pd2xCb3QueWFtbCIsImgiOiI5NjEyYmRmODZjZGIxYTg5NDg1OTgwNmYzMzk1ODI5ZjFjYmE0ZjFjIn0=
Copy-Tag: eyJwIjoiUmVzb3VyY2VTZXR0aW5ncy8uT3dsQm90LnlhbWwiLCJoIjoiOTYxMmJkZjg2Y2RiMWE4OTQ4NTk4MDZmMzM5NTgyOWYxY2JhNGYxYyJ9
  • Loading branch information
@gcf-owl-bot
gcf-owl-bot[bot] authored Jan 24, 2025
1 parent 3cb5af5 commit 7031f4a
Show file tree
Hide file tree
Showing 36 changed files with 294 additions and 0 deletions.
6 changes: 6 additions & 0 deletions OsConfig/src/V1/Client/OsConfigServiceClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -215,6 +215,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions OsConfig/src/V1/Client/OsConfigZonalServiceClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -410,6 +410,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions OsLogin/src/V1/Client/OsLoginServiceClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -210,6 +210,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions Parallelstore/src/V1/Client/ParallelstoreClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -317,6 +317,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions Parallelstore/src/V1beta/Client/ParallelstoreClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -337,6 +337,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions ParameterManager/src/V1/Client/ParameterManagerClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -228,6 +228,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions PolicySimulator/src/V1/Client/SimulatorClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -290,6 +290,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions PolicyTroubleshooter/src/V1/Client/IamCheckerClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,12 @@ private static function getClientDefaults()
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions PolicyTroubleshooterIam/src/V3/Client/PolicyTroubleshooterClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,12 @@ private static function getClientDefaults()
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions PrivateCatalog/src/V1beta1/Client/PrivateCatalogClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -134,6 +134,12 @@ private static function getClientDefaults()
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions PrivilegedAccessManager/src/V1/Client/PrivilegedAccessManagerClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -485,6 +485,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions Profiler/src/V2/Client/ExportServiceClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -157,6 +157,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
6 changes: 6 additions & 0 deletions Profiler/src/V2/Client/ProfilerServiceClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -182,6 +182,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down
32 changes: 32 additions & 0 deletions PubSub/src/V1/Client/PublisherClient.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
use Google\ApiCore\ApiException;
use Google\ApiCore\CredentialsWrapper;
use Google\ApiCore\GapicClientTrait;
use Google\ApiCore\InsecureCredentialsWrapper;
use Google\ApiCore\PagedListResponse;
use Google\ApiCore\ResourceHelperTrait;
use Google\ApiCore\RetrySettings;
Expand All @@ -49,6 +50,7 @@
use Google\Cloud\PubSub\V1\PublishResponse;
use Google\Cloud\PubSub\V1\Topic;
use Google\Cloud\PubSub\V1\UpdateTopicRequest;
use Grpc\ChannelCredentials;
use GuzzleHttp\Promise\PromiseInterface;
use Psr\Log\LoggerInterface;

Expand Down Expand Up @@ -252,6 +254,10 @@ public static function parseName(string $formattedName, ?string $template = null
/**
* Constructor.
*
* Setting the "PUBSUB_EMULATOR_HOST" environment variable will automatically set
* the API Endpoint to the value specified in the variable, as well as ensure that
* empty credentials are used in the transport layer.
*
* @param array $options {
* Optional. Options for configuring the service API wrapper.
*
Expand All @@ -266,6 +272,12 @@ public static function parseName(string $formattedName, ?string $template = null
* {@see \Google\Auth\FetchAuthTokenInterface} object or
* {@see \Google\ApiCore\CredentialsWrapper} object. Note that when one of these
* objects are provided, any settings in $credentialsConfig will be ignored.
* *Important*: If you accept a credential configuration (credential
* JSON/File/Stream) from an external source for authentication to Google Cloud
* Platform, you must validate it before providing it to any Google API or library.
* Providing an unvalidated credential configuration to Google APIs can compromise
* the security of your systems and data. For more information {@see
* https://cloud.google.com/docs/authentication/external/externally-sourced-credentials}
* @type array $credentialsConfig
* Options used to configure credentials, including auth token caching, for the
* client. For a full list of supporting configuration options, see
Expand Down Expand Up @@ -308,6 +320,7 @@ public static function parseName(string $formattedName, ?string $template = null
*/
public function __construct(array $options = [])
{
$options = $this->setDefaultEmulatorConfig($options);
$clientOptions = $this->buildClientOptions($options);
$this->setClientOptions($clientOptions);
}
Expand Down Expand Up @@ -657,4 +670,23 @@ public function testIamPermissions(TestIamPermissionsRequest $request, array $ca
{
return $this->startApiCall('TestIamPermissions', $request, $callOptions)->wait();
}

/** Configure the gapic configuration to use a service emulator. */
private function setDefaultEmulatorConfig(array $options): array
{
$emulatorHost = getenv('PUBSUB_EMULATOR_HOST');
if (empty($emulatorHost)) {
return $options;
}

if ($scheme = parse_url($emulatorHost, PHP_URL_SCHEME)) {
$search = $scheme . '://';
$emulatorHost = str_replace($search, '', $emulatorHost);
}

$options['apiEndpoint'] ??= $emulatorHost;
$options['transportConfig']['grpc']['stubOpts']['credentials'] ??= ChannelCredentials::createInsecure();
$options['credentials'] ??= new InsecureCredentialsWrapper();
return $options;
}
}
Loading

0 comments on commit 7031f4a

Please sign in to comment.