SessionsPythonPlugin bug fix

[westey (westey-m)]

Motivation and Context

Description

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[Copilot]

🟡 Changes recommended

The new allow-list check should be made case-insensitive (and redirect behavior should be addressed/documented) to ensure the security boundary is reliable in typical configurations.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR tightens outbound request allow-listing for the .NET SessionsPythonPlugin (Azure Container Apps dynamic sessions code interpreter) so requests are denied unless the session endpoint host is explicitly permitted, and updates tests/samples accordingly.

Changes:

• Make SessionsPythonPlugin deny requests unless SessionsPythonSettings.AllowedDomains contains the endpoint host (including when AllowedDomains is null/empty).
• Update unit tests to assert allow/deny behavior and add coverage for AllowedDomains == null and AllowedDomains empty.
• Update integration tests and the demo sample to configure AllowedDomains based on the configured endpoint host.

File summaries

File	Description
dotnet/src/Plugins/Plugins.UnitTests/Core/SessionsPythonPluginTests.cs	Adjusts allow-list tests and adds explicit deny tests for null/empty AllowedDomains.
dotnet/src/Plugins/Plugins.Core/CodeInterpreter/SessionsPythonSettings.cs	Updates AllowedDomains XML docs to reflect deny-by-default semantics.
dotnet/src/Plugins/Plugins.Core/CodeInterpreter/SessionsPythonPlugin.cs	Enforces deny-by-default allow-list check before sending requests.
dotnet/src/IntegrationTests/Plugins/Core/SessionsPythonPluginTests.cs	Configures AllowedDomains in integration test settings.
dotnet/samples/Demos/CodeInterpreterPlugin/Program.cs	Configures AllowedDomains in the demo for the configured session endpoint host.

Review details

Suppressed comments (2)

dotnet/src/Plugins/Plugins.Core/CodeInterpreter/SessionsPythonPlugin.cs:275

• Domain/host comparisons should be case-insensitive. Using the default Contains on IEnumerable<string> is case-sensitive, so an entry like EXAMPLE.COM will not match example.com even though hostnames are case-insensitive. Align this with the repository’s other allow-list plugins (e.g., HttpPlugin/WebFileDownloadPlugin) by using an OrdinalIgnoreCase comparer.

        if (this._settings.AllowedDomains?.Contains(uri.Host) != true)

dotnet/src/Plugins/Plugins.Core/CodeInterpreter/SessionsPythonPlugin.cs:277

• The exception message is hard to scan and doesn’t clearly state what was denied. Including the blocked host and using nameof makes it more actionable and less brittle if types/properties are renamed.

            throw new InvalidOperationException("Sending requests to the provided location is not allowed, add allowed domains to the AllowedDomains property on the SessionsPythonSettings.");

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): df581ff6eae8
Model: claude-opus-4.8

Overview

This PR fixes an insecure-default in SessionsPythonPlugin: the allowlist gate
previously evaluated to "allow" when AllowedDomains was null (the common
default), so it enforced nothing. The rewrite at
SessionsPythonPlugin.cs:275 (AllowedDomains?.Contains(uri.Host) != true) is
fail-closed on every branch — null, empty, and non-matching hosts all throw —
and SendAsync is the single choke point for all four HTTP operations, so no
path bypasses it. The change is well covered by new deny tests for the null
and empty cases (against the 169.254.169.254 metadata endpoint) and a rewritten
theory that asserts exact-host semantics. The one notable side effect is that
this is a deliberate, source-compatible but behavior-breaking change for callers
who never set AllowedDomains; that is the intended hardening and is documented
in the updated XML doc, sample, and tests, so it is captured as a release-note
follow-up rather than a code defect.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.