Address review feedback for Put Block From URL

Reject requests with a nonzero Content-Length since Put Block From
URL carries no body, and pin the loopback source fetch to the address
and port the server is actually bound to, taken from the connection
socket, so the client-controlled Host header can no longer redirect
the fetch to an arbitrary URL.  x-ms-source-if-tags is deliberately
not forwarded: unlike the Copy Blob operations, Put Block From URL
has no source tags condition and the generated operation spec does
not deserialize one.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: gaul

src/blob/handlers/BlockBlobHandler.ts

@@ -1,4 +1,5 @@
 import axios, { AxiosResponse } from "axios";
+import { IncomingMessage } from "http";
 
 import { convertRawHeadersToMetadata } from "../../common/utils/utils";
 import {
@@ -280,6 +281,14 @@ export default class BlockBlobHandler
     const blobName = blobCtx.blob!;
     const date = blobCtx.startTime!;
 
+    // Put Block From URL carries no request body.
+    if (contentLength !== 0) {
+      throw StorageErrorFactory.getInvalidHeaderValue(context.contextId, {
+        HeaderName: "Content-Length",
+        HeaderValue: contentLength.toString()
+      });
+    }
+
     this.validateBlockId(blockId, blobCtx);
 
     await this.metadataStore.checkContainerExist(
@@ -313,6 +322,24 @@ export default class BlockBlobHandler
       );
     }
 
+    // The Host header above is client-controlled, so never fetch the
+    // caller-supplied URL directly; pin the outbound request to the
+    // loopback address and port this server is actually bound to, keeping
+    // only the caller's path and query.
+    const rawRequest = blobCtx.request!.getBodyStream();
+    if (!(rawRequest instanceof IncomingMessage) ||
+      rawRequest.socket.localPort === undefined) {
+      throw StorageErrorFactory.getCannotVerifyCopySource(
+        context.contextId!,
+        404,
+        "The specified resource does not exist"
+      );
+    }
+    const scheme = "encrypted" in rawRequest.socket ? "https" : "http";
+    const pinnedUrl =
+      `${scheme}://127.0.0.1:${rawRequest.socket.localPort}` +
+      `${url.pathname}${url.search}`;
+
     // Fetch the source range over loopback so that SAS authentication,
     // range handling, and source conditions reuse the download path.
     const headers: { [key: string]: string } = {};
@@ -336,8 +363,11 @@ export default class BlockBlobHandler
         sourceConditions.sourceIfUnmodifiedSince
       ).toUTCString();
     }
+    // Note: unlike the Copy Blob operations, Put Block From URL has no
+    // x-ms-source-if-tags condition; the generated operation spec does not
+    // deserialize one.
 
-    const sourceResponse: AxiosResponse = await axios.get(sourceUrl, {
+    const sourceResponse: AxiosResponse = await axios.get(pinnedUrl, {
       headers,
       responseType: "stream",
       validateStatus: () => true

tests/blob/apis/blockblob.test.ts

@@ -341,6 +341,37 @@ describe("BlockBlobAPIs", () => {
     assert.ok(response.data.includes("SourceConditionNotMet"));
   });
 
+  it("stageBlockFromURL rejects a request body @loki @sql", async () => {
+    const content = "HelloWorldFromSourceBlob";
+    const sourceClient = containerClient.getBlockBlobClient(
+      getUniqueName("source")
+    );
+    await sourceClient.upload(content, content.length);
+    const sourceUrl = await sourceClient.generateSasUrl({
+      permissions: BlobSASPermissions.parse("r"),
+      expiresOn: new Date(Date.now() + 60 * 60 * 1000)
+    });
+    const destinationUrl = await blockBlobClient.generateSasUrl({
+      permissions: BlobSASPermissions.parse("rw"),
+      expiresOn: new Date(Date.now() + 60 * 60 * 1000)
+    });
+
+    const response = await axios.put(
+      destinationUrl +
+        "&comp=block&blockid=" +
+        encodeURIComponent(base64encode("1")),
+      "unexpected body",
+      {
+        headers: {
+          "x-ms-copy-source": sourceUrl
+        },
+        validateStatus: () => true
+      }
+    );
+    assert.deepStrictEqual(response.status, 400);
+    assert.ok(response.data.includes("InvalidHeaderValue"));
+  });
+
   it("stageBlockFromURL from a missing source returns 404 @loki @sql", async () => {
     const missingClient = containerClient.getBlockBlobClient(
       getUniqueName("missing")