Support tools that require oauth

[imranq2]

No description provided.

[aikido-pr-checks]

Potential user input in HTTP request may allow SSRF attack - medium severity
If an attacker can control the URL input leading into this HTTP request, the attack might be able to perform an SSRF attack. This kind of attack is even more dangerous if the application returns the response of the request to the user. It could allow them to retrieve information from higher privileged services within the network (such as the metadata service, which is commonly available in cloud services, and could allow them to retrieve credentials).

Remediation - medium confidence
This patch mitigates the opening of potentially unsafe URLs by implementing validation for URLs passed to urllib_urlopen.

Suggested change

	token_response = requests.post(
	well_known_configuration.token_endpoint, data=token_data
	)
	token_endpoint = well_known_configuration.token_endpoint
	if not token_endpoint.startswith(('https://', 'http://')):
	raise ValueError("Invalid token endpoint URL")
	token_response = requests.post(token_endpoint, data=token_data)

^{View details in Aikido Security}