[EventGrid] Fix credential leak on cross-host redirect in legacy publisher (MSRC 126697)

.github/CODEOWNERS

@@ -246,7 +246,7 @@
 # AzureSdkOwners: @rajeshka @shankarsama
 # ServiceLabel: %Event Grid
 # PRLabel: %Event Grid
-/sdk/eventgrid/    @rajeshka @shankarsama
+/sdk/eventgrid/    @shankarsama @Nishanth-MS
 
 # PRLabel: %Event Hubs
 /sdk/eventhub/    @axisc @hmlam @j7nw4r @SwayGom @sagar0207 @sjkwak

sdk/eventgrid/azure-eventgrid/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Release History
 
+## 4.22.1 (2026-07-28)
+
+### Bugs Fixed
+
+- Fixed a security issue where the legacy `EventGridPublisherClient` (sync and async) could re-send credential headers to a different host when following an HTTP 3xx redirect. A `SensitiveHeaderCleanupPolicy` is now added to the pipeline to strip `Authorization`, `aeg-sas-key` and `aeg-sas-token` headers on cross-host redirects.
+
+### Other Changes
+
+- Raised the minimum `azure-core` dependency to `1.38.3` so that credential headers remain stripped across retries following a cross-host redirect (`insecure_domain_change` flag persistence).
+- Increased the minimum supported Python version to 3.10. Python 3.9 and earlier are no longer supported.
+
 ## 4.22.0 (2025-05-14)
 
 ### Features Added

sdk/eventgrid/azure-eventgrid/README.md

@@ -17,7 +17,7 @@ This is a GA release of Azure Event Grid's `EventGridPublisherClient` and `Event
 ## Getting started
 
 ### Prerequisites
-* Python 3.8 or later is required to use this package.
+* Python 3.10 or later is required to use this package.
 * You must have an [Azure subscription][azure_subscription] and at least one of the following:
     * an Event Grid Namespace resource. To create an Event Grid Namespace resource follow [this tutorial](https://learn.microsoft.com/azure/event-grid/create-view-manage-namespaces).
     * an Event Grid Basic resource. To create an Event Grid Basic resource via the Azure portal follow this [step-by-step tutorial](https://learn.microsoft.com/azure/event-grid/custom-event-quickstart-portal). To create an Event Grid Basic resource via the [Azure CLI](https://learn.microsoft.com/cli/azure) follow this [tutorial](https://learn.microsoft.com/azure/event-grid/custom-event-quickstart)

sdk/eventgrid/azure-eventgrid/api.metadata.yml

@@ -0,0 +1,3 @@
+apiMdSha256: dcc804237da14b8d346f7881e23a570a9639c4784861a319246e65309b46b724
+parserVersion: 0.3.30
+pythonVersion: 3.13.14

sdk/eventgrid/azure-eventgrid/azure/eventgrid/_legacy/_publisher_client.py

@@ -20,6 +20,7 @@
     DistributedTracingPolicy,
     HttpLoggingPolicy,
     UserAgentPolicy,
+    SensitiveHeaderCleanupPolicy,
 )
 from azure.core.exceptions import (
     ClientAuthenticationError,
@@ -121,6 +122,16 @@ def _policies(
         **kwargs: Any
     ) -> List[Any]:
         auth_policy = _get_authentication_policy(credential)
+        # Merge any caller-supplied blocked redirect headers with the mandatory
+        # Event Grid credential headers, and remove the key from kwargs so it is
+        # not passed twice to SensitiveHeaderCleanupPolicy.
+        blocked_redirect_headers = [
+            "Authorization",
+            "x-ms-authorization-auxiliary",
+            "aeg-sas-key",
+            "aeg-sas-token",
+            *kwargs.pop("blocked_redirect_headers", []),
+        ]
         sdk_moniker = "eventgrid/{}".format(VERSION)
         policies = [
             RequestIdPolicy(**kwargs),
@@ -131,6 +142,14 @@ def _policies(
             RedirectPolicy(**kwargs),
             RetryPolicy(**kwargs),
             auth_policy,
+            # Strip credential headers on cross-host redirects to avoid leaking them to
+            # a redirect target. `SensitiveHeaderCleanupPolicy` already covers
+            # `Authorization` and `x-ms-authorization-auxiliary` by default; the Event
+            # Grid SAS headers (`aeg-sas-key`/`aeg-sas-token`) are added here as well.
+            SensitiveHeaderCleanupPolicy(
+                blocked_redirect_headers=blocked_redirect_headers,
+                **kwargs,
+            ),
             CustomHookPolicy(**kwargs),
             NetworkTraceLoggingPolicy(**kwargs),
             DistributedTracingPolicy(**kwargs),

sdk/eventgrid/azure-eventgrid/azure/eventgrid/_legacy/aio/_publisher_client_async.py

@@ -23,6 +23,7 @@
     HttpLoggingPolicy,
     UserAgentPolicy,
     AsyncBearerTokenCredentialPolicy,
+    SensitiveHeaderCleanupPolicy,
 )
 from azure.core.exceptions import (
     ClientAuthenticationError,
@@ -115,6 +116,16 @@ def _policies(
         credential: Union[AzureKeyCredential, AzureSasCredential, "AsyncTokenCredential"], **kwargs: Any
     ) -> List[Any]:
         auth_policy = _get_authentication_policy(credential, AsyncBearerTokenCredentialPolicy)
+        # Merge any caller-supplied blocked redirect headers with the mandatory
+        # Event Grid credential headers, and remove the key from kwargs so it is
+        # not passed twice to SensitiveHeaderCleanupPolicy.
+        blocked_redirect_headers = [
+            "Authorization",
+            "x-ms-authorization-auxiliary",
+            "aeg-sas-key",
+            "aeg-sas-token",
+            *kwargs.pop("blocked_redirect_headers", []),
+        ]
         sdk_moniker = "eventgridpublisherclient/{}".format(VERSION)
         policies = [
             RequestIdPolicy(**kwargs),
@@ -125,6 +136,14 @@ def _policies(
             AsyncRedirectPolicy(**kwargs),
             AsyncRetryPolicy(**kwargs),
             auth_policy,
+            # Strip credential headers on cross-host redirects to avoid leaking them to
+            # a redirect target. `SensitiveHeaderCleanupPolicy` already covers
+            # `Authorization` and `x-ms-authorization-auxiliary` by default; the Event
+            # Grid SAS headers (`aeg-sas-key`/`aeg-sas-token`) are added here as well.
+            SensitiveHeaderCleanupPolicy(
+                blocked_redirect_headers=blocked_redirect_headers,
+                **kwargs,
+            ),
             CustomHookPolicy(**kwargs),
             NetworkTraceLoggingPolicy(**kwargs),
             DistributedTracingPolicy(**kwargs),

sdk/eventgrid/azure-eventgrid/azure/eventgrid/_model_base.py

@@ -774,16 +774,16 @@ def _get_deserialize_callable_from_annotation(  # pylint: disable=too-many-retur
 
     # is it optional?
     try:
-        if any(a for a in annotation.__args__ if a == type(None)):  # pyright: ignore
+        if any(a for a in annotation.__args__ if a == type(None)):  # pyright: ignore # pylint: disable=unidiomatic-typecheck
             if len(annotation.__args__) <= 2:  # pyright: ignore
                 if_obj_deserializer = _get_deserialize_callable_from_annotation(
-                    next(a for a in annotation.__args__ if a != type(None)), module, rf  # pyright: ignore
+                    next(a for a in annotation.__args__ if a != type(None)), module, rf  # pyright: ignore # pylint: disable=unidiomatic-typecheck
                 )
 
                 return functools.partial(_deserialize_with_optional, if_obj_deserializer)
             # the type is Optional[Union[...]], we need to remove the None type from the Union
             annotation_copy = copy.copy(annotation)
-            annotation_copy.__args__ = [a for a in annotation_copy.__args__ if a != type(None)]  # pyright: ignore
+            annotation_copy.__args__ = [a for a in annotation_copy.__args__ if a != type(None)]  # pyright: ignore # pylint: disable=unidiomatic-typecheck
             return _get_deserialize_callable_from_annotation(annotation_copy, module, rf)
     except AttributeError:
         pass

sdk/eventgrid/azure-eventgrid/azure/eventgrid/_serialization.py

@@ -189,7 +189,7 @@ def deserialize_from_http_generics(cls, body_bytes: Optional[Union[AnyStr, IO]],
 class UTC(datetime.tzinfo):
     """Time Zone info for handling UTC"""
 
-    def utcoffset(self, dt):
+    def utcoffset(self, dt):  # pylint: disable=unused-argument
         """UTF offset for UTC is 0.
 
         :param datetime.datetime dt: The datetime
@@ -198,7 +198,7 @@ def utcoffset(self, dt):
         """
         return datetime.timedelta(0)
 
-    def tzname(self, dt):
+    def tzname(self, dt):  # pylint: disable=unused-argument
         """Timestamp representation.
 
         :param datetime.datetime dt: The datetime
@@ -207,7 +207,7 @@ def tzname(self, dt):
         """
         return "Z"
 
-    def dst(self, dt):
+    def dst(self, dt):  # pylint: disable=unused-argument
         """No daylight saving for UTC.
 
         :param datetime.datetime dt: The datetime
@@ -230,16 +230,16 @@ class _FixedOffset(datetime.tzinfo):  # type: ignore
         def __init__(self, offset) -> None:
             self.__offset = offset
 
-        def utcoffset(self, dt):
+        def utcoffset(self, dt):  # pylint: disable=unused-argument
             return self.__offset
 
-        def tzname(self, dt):
+        def tzname(self, dt):  # pylint: disable=unused-argument
             return str(self.__offset.total_seconds() / 3600)
 
         def __repr__(self):
             return "<FixedOffset {}>".format(self.tzname(None))
 
-        def dst(self, dt):
+        def dst(self, dt):  # pylint: disable=unused-argument
             return datetime.timedelta(0)
 
         def __getinitargs__(self):

sdk/eventgrid/azure-eventgrid/azure/eventgrid/_version.py

@@ -6,4 +6,4 @@
 # Changes may cause incorrect behavior and will be lost if the code is regenerated.
 # --------------------------------------------------------------------------
 
-VERSION = "4.22.0"
+VERSION = "4.22.1"

sdk/eventgrid/azure-eventgrid/dev_requirements.txt

@@ -4,5 +4,9 @@
 azure-mgmt-resource==22.0.0
 ../azure-mgmt-eventgrid
 azure-storage-queue
-cloudevents<=2.0.0; python_version >= "3.7"
+# Pin to cloudevents 1.x: 2.0.0 is a backwards-incompatible rewrite that removed the
+# `cloudevents.http` module the CNCF tests/samples import. This is a test-only dependency
+# (not in install_requires); the `<=2.0.0` pin was a latent issue that broke once 2.0.0
+# shipped. TODO: migrate the CNCF tests/samples to the cloudevents 2.x API and relax this pin.
+cloudevents<2.0.0; python_version >= "3.7"
 aiohttp>=3.0

sdk/eventgrid/azure-eventgrid/setup.py

@@ -42,11 +42,11 @@
         "Programming Language :: Python",
         "Programming Language :: Python :: 3 :: Only",
         "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.8",
-        "Programming Language :: Python :: 3.9",
         "Programming Language :: Python :: 3.10",
         "Programming Language :: Python :: 3.11",
         "Programming Language :: Python :: 3.12",
+        "Programming Language :: Python :: 3.13",
+        "Programming Language :: Python :: 3.14",
         "License :: OSI Approved :: MIT License",
     ],
     zip_safe=False,
@@ -63,8 +63,8 @@
     },
     install_requires=[
         "isodate>=0.6.1",
-        "azure-core>=1.30.0",
+        "azure-core>=1.38.3",
         "typing-extensions>=4.6.0",
     ],
-    python_requires=">=3.8",
+    python_requires=">=3.10",
 )