{Storage} Validate blob copy source endpoint

[YangAn-microsoft]

Description

Improve az storage blob copy start endpoint validation before destination credentials are reused for a source blob. The source and destination URLs must now have the same normalized origin, including scheme, hostname, and effective port.

Structured same-account blob sources validated by Azure CLI preserve the existing credential reuse behavior, including when custom endpoints are configured. Arbitrary source URLs must match the destination origin and, when available, the parsed storage account identity.

The normalization supports hostname case, default ports, trailing DNS separators, IDNA hostnames, IPv4/IPv6 endpoints, sovereign clouds, custom endpoints, and path-style emulator endpoints.

Testing Guide

Offline regression tests

Added coverage for:

• equivalent public, sovereign, custom, IPv4, and IPv6 origins
• mismatched schemes, ports, userinfo, and hostname suffixes
• IDNA normalization edge cases
• structured same-account source provenance
• distinct accounts on path-style endpoints
• BlockBlob, AppendBlob, and PageBlob copy paths
• preserving credential reuse for equivalent source and destination origins

Result: 9 passed, 18 subtests passed.

Live Azure tests

Ran the complete test_storage_blob_copy_scenarios.py module against an Azure subscription with AZURE_TEST_RUN_LIVE=True.

Result: 11 passed, 4 environment/preparer failures in 22m 21s. Of the 11 passes, 6 were resource-backed live scenarios and 5 were the offline security tests in the same module.

Live scenarios that passed:

• test_storage_blob_copy_batch
• test_storage_blob_copy_batch_destination_blob_type
• test_storage_blob_copy_batch_rehydrate_priority
• test_storage_blob_copy_destination_blob_type
• test_storage_blob_copy_requires_sync
• test_storage_blob_show_with_copy_in_progress

The four remaining scenarios did not reach the affected copy operation:

• test_storage_blob_copy_oauth and test_storage_blob_copy_batch_oauth: the test identity lacked a Storage Blob data-plane role (AuthorizationPermissionMismatch).
• test_storage_blob_copy_same_account_sas and test_storage_blob_copy_with_sas_and_snapshot: resource preparation requested legacy account kind Storage, which the test subscription rejected (AccountKindNotSupported).

The two scenarios most directly covering this change were then rerun by exact test ID:

• test_storage_blob_copy_destination_blob_type
• test_storage_blob_copy_requires_sync

Result: 2 passed in 7m 13s.

[Yong Zhang (yonzhan)]

Storage

[Copilot]

Copilot review overview

🟡 Changes recommended

Same-account provenance can bypass origin validation without a present, validated account identity.

Review effort: Balanced
Findings: 1

Open (1)

• same_account bypasses origin validation with invalid account names · New

What changed in this PR

Improves credential-reuse security for az storage blob copy start.

Changes:

• Normalizes and compares source/destination URL origins.
• Tracks validated same-account structured sources.
• Adds regression coverage for endpoint and blob-type variations.

File	Description
_validators.py	Records same-account source provenance.
_params.py	Registers the internal provenance argument.
operations/​blob.py	Validates origins before credential reuse.
test_storage_validators.py	Tests source provenance validation.
test_storage_blob_copy_scenarios.py	Tests normalization and credential reuse.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[x-engineering-agent]

Automated sensitive-information remediation ran on this pull request.

• Detected categories: email address
• Replaced with typed [REDACTED:category] placeholders in: no PR metadata fields
• Comment/review owners notified because X Engineering Agent cannot edit another user's text: Copilot

X Engineering Agent does not modify source files. The PR creator must remove or replace each suspected value at the linked line:

• No changed-file findings

If a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment.

✅ Confirm the finding · ❌ Dispute the finding

GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices.

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-codegen-extensibility-squad.

[x-engineering-agent]

Automated sensitive-information remediation ran on this pull request.

• Detected categories: email address
• Replaced with typed [REDACTED:category] placeholders in: no PR metadata fields
• Comment/review owners notified because X Engineering Agent cannot edit another user's text: Copilot, YangAn-microsoft

X Engineering Agent does not modify source files. The PR creator must remove or replace each suspected value at the linked line:

• No changed-file findings

If a credential was exposed, rotate or revoke it immediately. Detected values are never copied into this comment.

✅ Confirm the finding · ❌ Dispute the finding

GitHub only supports a fixed reaction set, so 👍 represents ✅ and 👎 represents ❌. The bot-created reactions are only poll choices.

[Copilot]

Copilot review overview

🟢 Approval recommended

The endpoint validation is correctly integrated and comprehensively covers the affected credential-reuse paths.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• same_account bypasses origin validation with invalid account names

[x-engineering-agent]

YangAn-microsoft

Review

One PR-related compatibility regression remains in the custom-endpoint copy path.

Domain edge-case reviewer

Medium - Same-origin custom endpoints can reject an already SAS-authorized copy. In storage/operations/blob.py:1137-1141, accepting an unavailable source account name enables credential reuse where the previous account-name comparison did not. With a custom --blob-endpoint, an explicitly named destination account/key, a same-origin SAS source URI, and an explicit BlockBlob, AppendBlob, or PageBlob destination, the source client can have account_name=None while the destination credential retains its account name.

The newly reached generate_sas_blob_uri path at lines 882-887 reconstructs the custom-endpoint client with only the key string, losing that known identity. The pinned azure-storage-blob==12.29.0b1 SDK rejects this combination with Unable to determine account name for shared key credential. before sending the copy. Previously the original usable source SAS was retained.

Keep the origin guard, but preserve the resolved account identity when constructing the temporary SAS client, for example with a named/dictionary credential rather than a bare key.

Upstream CI

All 50 current-head checks passed for b11e85515979155c20f0a6ef6b44c1f3b4e14469. The finding above comes from static tracing of the changed path and pinned SDK, not an observed Agent live-test failure.

Test validation

• Agent live test: Not run; this is a review-only PR. Check author-provided test evidence and upstream CI separately.
• Regression coverage: For storage: 2 focused test file(s) changed. Scenario coverage is unverified; review the issue's required conditions, test setup, and assertions before approval. No linked issue was found in the PR timeline; inspect the source issue and its required scenario manually.

The added operation tests mock both SDK clients and generate_sas_blob_uri, hiding this failure; the validator tests mock credential resolution. Extend test_storage_blob_copy_scenarios.py's StorageBlobCopySecurityTests.test_storage_blob_copy_reuses_credentials_for_same_source_origin with real SDK clients and SAS generation, mocking network operations only. Cover a SAS-authorized custom-origin source for all three explicit destination types, asserting that copying reaches the destination operation and preserves valid source authorization. Rerun azdev test test_storage_blob_copy_scenarios test_storage_validators in the configured PR-validation environment. The existing StorageBlobCopyTests.test_storage_blob_copy_destination_blob_type and test_storage_blob_copy_requires_sync remain the focused service-compatibility scenarios, but their ordinary-account setup does not establish custom-origin coverage.

Author-provided evidence: The author reports six resource-backed live scenario passes and two later focused rerun passes. The four reported RBAC/preparer failures (AuthorizationPermissionMismatch and AccountKindNotSupported) reportedly occurred before the affected copy operation; they are not evidence of a failure in this changed path. These results are distinct from Agent execution. No missing recording is independently established: the additions are unit tests and the existing resource-backed cases use LiveScenarioTest, not recording playback.

Risk assessment

46/100 · Medium · High confidence

The Medium rating is driven by security-sensitive behavior, public CLI behavior.

• Change scope: 5 changed files, 273 changed lines (+272 / -1), including 3 production files.
• Affected components: storage
• Risk drivers: security-sensitive behavior (+28); public CLI behavior (+18)
• Regression evidence: Changed regression tests are included, reducing risk.
• Confidence: High because changed-line patches were available for every production file.
• Required review: Owning-squad review is required for storage before merge.

Posted by x-engineering-agent (Reviewer)

[microsoft-github-policy-service]

🔔 Routing this PR to @Azure/act-codegen-extensibility-squad.