[Vinothini Dharmaraj (v-dharmarajv)]

Description

Fixes a recording URL validation bypass in azure-communication-callautomation that could allow an authenticated request to an unintended endpoint when an application supplies an attacker-influenced recording URL.

The previous implementation validated URLs using urllib.parse but passed the original string to the HTTP transport. Literal backslashes before @ could cause the validator and Requests/urllib3 to interpret different destination hosts, potentially exposing the application's Bearer token.

Changes

Reject recording URLs containing raw backslashes, whitespace, control characters, user-info, or malformed authorities.
Require HTTPS and valid ASCII DNS hostnames within the existing ACS recording endpoint allowlist.
Canonicalize the validated authority and use the returned URL when constructing requests.
Add a shared pipeline policy that revalidates recording destinations before authentication on retries and redirects.
Apply the protection to synchronous and asynchronous recording downloads and deletes.
Preserve valid ACS redirects and signed query parameters.
Add regression coverage for malformed URLs, external destinations, redirects, and the default Requests and aiohttp transports.
Document the security fix and version-specific deprecation of 1.6.0, recommending upgrade to 1.6.1 or a later fixed release.
No service API specification changes or SDK regeneration are involved. Public method signatures remain unchanged; previously accepted unsafe URLs are intentionally rejected.

The branch also includes recording test fixture and playback asset updates.

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• Pull request includes test coverage for the included changes.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

[Pilot] PR Pipeline Failure Analysis

What failed

Build 6991592 of "python - pullrequest" (https://dev.azure.com/azure-sdk/public/_build/results?buildId=6991592) failed in Build Analyze, Build Build Docs, and the Build Test sub-steps on all platforms (Ubuntu 2404 3.10/3.13/3.14, Windows2022 3.12). 448 unit tests passed in every job — there are no real test failures.

1. Build Build Docs (sphinx) — caused by this PR

docgen/index.md:27: WARNING: 'myst' cross-reference target not found: 'CHANGELOG.md' [myst.xref_missing]
build finished with problems, 1 warning (with warnings treated as errors).
[ERROR] azure-sdk-tools: sphinx-build failed for path .../docgen exited with error 1

This PR's new README.md "Security notice" section adds Refer to the [release history](CHANGELOG.md) .... Docgen/sphinx staging doesn't resolve this relative sibling-file link as a valid cross-reference, and the warning is promoted to a hard failure.

2. Build Analyze — markdown link checker — same root cause

'(redacted) has 1 broken link(s):
  CHANGELOG.md
Checked 16 links with 1 broken link(s) found.
##[error]PowerShell exited with code '1'.

3. Build Analyze — cspell check — infrastructure, unrelated to this PR

npm error code EPERM ... FetchError: request to (registry.npmjs.org/redacted) failed
npm error request to (registry.npmjs.org/redacted) failed
##[error]CSpell exited with code 1.

npm can't reach registry.npmjs.org to install the cspell tool — an agent network restriction.

4. Build Test (all platforms) — mindependency check — infrastructure, unrelated to this PR

Dependency resolution failed for azure-communication-callautomation: HTTPSConnectionPool(host='pypi.org', port=443): Max retries exceeded with url: /pypi/azure-identity/1.26.0/json
(Caused by NewConnectionError('...: [WinError 10013] An attempt was made to access a socket in a way forbidden by its access permissions'))

Identical failure (network-forbidden socket) reproduces across every platform/Python version, confirming it's a CI sandbox restriction, not a code issue. All whl/sdist checks in the same jobs pass.

Recommended next steps

• Fix: In sdk/communication/azure-communication-callautomation/README.md, change the [release history](CHANGELOG.md) link to a form the docgen/link-checker resolves (e.g. ./CHANGELOG.md or the full GitHub blob URL to the file), matching the convention used elsewhere in this README for cross-file references.
• The cspell/npm EPERM and mindependency pypi.org connection failures are CI-agent network restrictions, not caused by this PR — retry the pipeline; escalate to pipeline infra owners if they persist.
• See https://aka.ms/ci-fix

Automated fix: Requested

Generated by Pipeline Analysis Next Steps · copilot · sonnet50 · 131.2 AIC · ⌖ 0.568 AIC · ⊞ 8.9K · ◷