Fix SSRF / credential exfiltration via api_endpoint (b/565094291)

[erinlimbogoogle]

Fix SSRF / credential exfiltration via api_endpoint (b/565094291)

📌 Summary

Property	Details
Issue ID	b/565094291
Component	QueryDataAPIGenerator
Vulnerability	Server-Side Request Forgery (SSRF) / Credential Exfiltration
Mitigation	Early endpoint allowlist validation in __init__ prior to client creation

---

⚠️ Problem & Security Impact

QueryDataAPIGenerator previously accepted an arbitrary api_endpoint from client-supplied model configurations (EvalConfig). The server then transmitted its Application Default Credentials (ADC) to that endpoint:

Transport Path	Implementation Mechanism
gRPC	Passed directly via DataChatServiceClient(client_options=...)
REST	Dispatched via Authorization: Bearer <token> request header

Impact: A caller submitting an EvalConfig could steer the server's access token to an attacker-controlled host.

---

💡 Solution & Validation Rules

The api_endpoint parameter is now validated in __init__ before initializing the service client. Hostnames must strictly match an allowlist of bare Google domain patterns:

Host Category	Pattern / Allowlist Rule	Action
Production	Bare geminidataanalytics.googleapis.com and *-/* prefixes	Allowed
Test Environments	*.sandbox.googleapis.com	Allowed
Default Settings	Default endpoint configuration	Unchanged
Invalid Inputs	Schemes (https://), paths, ports (:443), userinfo, or suffix lookalikes	Raises ValueError

---

✅ Test Coverage

Added 4 comprehensive unit tests:

Test Suite	Verification Scope
Host Allowlist	Validates accepted bare production and sandbox hostnames
Normalization	Ensures valid hostnames normalize predictably
Rejection Scenarios	Tests ~20 adversarial inputs (schemes, paths, ports, suffix spoofs) raise ValueError
Credential Guard (REST)	Verifies the REST path never fetches a token or issues a request for rejected hosts