mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-11-09 12:49:27 +00:00
Lydia Vilchez
d6354068af
Address the 15 findings from the SDK code review: - Certificate bundle validation now walks every PEM certificate block so intermediate-before-leaf order (openssl / Key Vault exports) is accepted, covers encrypted PKCS#8/DSA/OpenSSH private-key labels, and catches cryptography.UnsupportedAlgorithm alongside ValueError. - validate_arguments rejects --certificate-content/--certificate-path without --certificate-auth (or a full static-credentials trio) and no longer requires --tenant-id when --certificate-auth is used with an env-var flow. --certificate-auth --tenant-id X no longer mistakenly raises the browser-auth error. - setup_session prefers explicit --tenant-id over AZURE_TENANT_ID on the env-var certificate path, gates the env-var check on the absence of a static-credentials dict, runs validate_certificate_bundle before instantiating CertificateCredential, and maps base64/OS errors to typed certificate errors. - verify_client runs the certificate get_token off-thread with a 30s hard timeout so a stalled Entra ID endpoint cannot pin a request thread or Celery worker, and catches the same base64/OS errors on the certificate branch. - _compute_certificate_thumbprint logs each parser failure instead of silently discarding them, and the setattr on CertificateCredential falls back to a module-level map keyed by id() so a future azure-identity release that adds __slots__ cannot break the feature.