blob/azureblob: prevent SAS token endpoint overrides

[huynhtrungcip]

This change prevents the default azblob:// opener from changing the service origin through bucket URL parameters when AZURE_STORAGE_SAS_TOKEN is set.

The SAS token is appended to the service URL. The revised check compares the configured and overridden origins instead of maintaining a domain allowlist.

Existing behavior is preserved when no SAS token is configured, when URL parameters leave the origin unchanged, and for endpoints configured through environment variables or a custom URLOpener.

Tests:

• go test ./blob/azureblob -count=1
• go test ./blob/... -count=1
• go test ./... -count=1
• go run github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.0 run

[vangent]

Can you explain why you think this change is needed?

[huynhtrungcip]

Thanks for taking a look.

The reason for this change is that the registered azblob:// opener combines endpoint selection from the bucket URL with credentials loaded from the environment/default Azure configuration.

Today, if an application accepts or composes an azblob:// URL from lower-trust configuration, the URL can set domain and protocol while the opener still applies credentials from AZURE_STORAGE_SAS_TOKEN, shared key, or default Azure credentials. That means a bucket URL can choose the service endpoint that receives credential-bearing Azure Blob requests.

This PR keeps custom endpoints available through trusted ServiceURLOptions or environment configuration, but stops the bucket URL query string from selecting arbitrary service domains or downgrading the endpoint to HTTP. I used that boundary because blob.OpenBucket URLs are commonly treated as configuration strings, while ServiceURLOptions/environment setup is controlled by the application deployer.

I rechecked the patch locally:

• go test ./blob/azureblob -count=1
• go test ./blob/... -count=1
• go test ./... -count=1
• (cd internal/website/gatherexamples && go test -count=1)
• internal/website/gatherexamples/run.sh | diff -u internal/website/data/examples.json -

If you prefer a narrower compatibility-preserving approach, I can adjust the patch so the restriction only applies when the default registered opener is using environment/default credentials.

[vangent]

I'm not sure I'm convinced this belongs here.

If applications are accepting arbitrary config URLs and passing them to this library, they can/should do some verification of them before that. I would expect most applications to have control over both the configuration and the environment.

[huynhtrungcip]

PTAL. I removed the domain allowlist and narrowed the change to SAS tokens in the default opener. URL overrides are rejected only when they change the configured origin; existing custom-domain and Azurite behavior remains unchanged. All repository tests and golangci-lint v2.12 pass.

[codecov]

Codecov Report

❌ Patch coverage is 47.82609% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.25%. Comparing base (34e0cf5) to head (6cc45db).

Files with missing lines	Patch %	Lines
blob/azureblob/azureblob.go	47.82%	6 Missing and 6 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3737      +/-   ##
==========================================
- Coverage   75.28%   75.25%   -0.04%     
==========================================
  Files         104      104              
  Lines       14176    14199      +23     
==========================================
+ Hits        10672    10685      +13     
- Misses       2772     2776       +4     
- Partials      732      738       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.