Fix GCP Service Agent Token Theft vulnerability in connection testing

[akkaur]

This PR updates GCPUtils.loadServiceAccountCredentials to emit a WARN audit log whenever the credentials supplied (via file path or JSON) are not of the standard service_account type (e.g., external_account, authorized_user, impersonated_service_account).

There is no change to existing credential parsing behavior.

[gemini-code-assist]

Code Review

This pull request updates GCPUtils.loadServiceAccountCredentials to load credentials using ServiceAccountCredentials.fromStream instead of GoogleCredentials.fromStream and adds corresponding unit tests. The feedback suggests enhancing the positive test case by asserting that the returned credentials are an instance of ServiceAccountCredentials to ensure the security fix is explicitly verified.

[akkaur]

/gemini review

[akkaur]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates the loadServiceAccountCredentials method in GCPUtils to return ServiceAccountCredentials instead of GoogleCredentials, preventing the loading of non-service-account credentials. A new test class GCPUtilsTest has been added to validate this behavior with both positive and negative test cases. I have no feedback to provide.

[gemini-code-assist]

The changes in this pull request correctly address the identified security vulnerability by restricting credential parsing to ServiceAccountCredentials. This prevents the use of malicious external_account payloads that could lead to token exfiltration. The addition of GCPUtilsTest.java provides essential regression testing to ensure this restriction remains in place. The implementation is robust and follows security best practices for GCP credential handling.

[gemini-code-assist]

Code Review

This pull request updates GCPUtils to load credentials specifically as ServiceAccountCredentials instead of the generic GoogleCredentials to mitigate potential external account payload attacks, and introduces unit tests to verify this behavior. The review feedback suggests programmatically generating a dummy RSA keypair at runtime in the test instead of hardcoding a static private key string, which prevents triggering automated credential scanners in CI/CD pipelines.

[akkaur]

/gemini review

[gemini-code-assist]

Code Review

This pull request updates GCPUtils.loadServiceAccountCredentials to load credentials using ServiceAccountCredentials.fromStream instead of the generic GoogleCredentials.fromStream to prevent loading arbitrary external account credentials. Additionally, a new test class GCPUtilsTest has been added to verify both positive and negative scenarios for loading service account credentials. No review comments were provided, so there is no feedback to address.