fix(custom-resources-handlers): s3 deployment handler log injection v…

…ulnerability (#28599) The `bucket-deployment-handler` results vulnerable to [CWE-117](https://cwe.mitre.org/data/definitions/117.html) and [CWE-93](https://cwe.mitre.org/data/definitions/93.html) according to AWS Inspector. This fix mitigates the vulnerability by sanitizing the logged `message` as suggested on [Veracode](https://community.veracode.com/s/article/How-to-Fix-CWE-117-Improper-Output-Neutralization-for-Logs). **Note** Inspector suggestion of using `urllib.parse.quote` would produce unreadable messages, so I opted for `encoded`. Closes #28469. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
aws · Feb 23, 2024 · 83aa395 · 83aa395
1 parent fcb7231
commit 83aa395
Show file tree

Hide file tree

Showing 32 changed files with 69 additions and 60 deletions.
diff --git a/...ic-beanstalk-deploy.js.snapshot/aws-cdk-codepipeline-elastic-beanstalk-deploy.assets.json b/...ic-beanstalk-deploy.js.snapshot/aws-cdk-codepipeline-elastic-beanstalk-deploy.assets.json
diff --git a/...-beanstalk-deploy.js.snapshot/aws-cdk-codepipeline-elastic-beanstalk-deploy.template.json b/...-beanstalk-deploy.js.snapshot/aws-cdk-codepipeline-elastic-beanstalk-deploy.template.json
@@ -319,7 +319,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {

diff --git a/...s-codepipeline-actions/test/integ.pipeline-elastic-beanstalk-deploy.js.snapshot/tree.json b/...s-codepipeline-actions/test/integ.pipeline-elastic-beanstalk-deploy.js.snapshot/tree.json
diff --git a/...ramework-integ/test/aws-dynamodb/test/integ.import-source.js.snapshot/S3Stack.assets.json b/...ramework-integ/test/aws-dynamodb/test/integ.import-source.js.snapshot/S3Stack.assets.json
diff --git a/...mework-integ/test/aws-dynamodb/test/integ.import-source.js.snapshot/S3Stack.template.json b/...mework-integ/test/aws-dynamodb/test/integ.import-source.js.snapshot/S3Stack.template.json
@@ -328,7 +328,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {

diff --git a/...-testing/framework-integ/test/aws-dynamodb/test/integ.import-source.js.snapshot/tree.json b/...-testing/framework-integ/test/aws-dynamodb/test/integ.import-source.js.snapshot/tree.json
diff --git a/...-integ/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/aws-ecs-integ.assets.json b/...-integ/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/aws-ecs-integ.assets.json
diff --git a/...nteg/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/aws-ecs-integ.template.json b/...nteg/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/aws-ecs-integ.template.json
@@ -1340,7 +1340,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {

diff --git a/...esting/framework-integ/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/tree.json b/...esting/framework-integ/test/aws-ecs/test/ec2/integ.environment-file.js.snapshot/tree.json
diff --git a/...test/integ.bucket-deployment-cloudfront.js.snapshot/test-bucket-deployments-1.assets.json b/...test/integ.bucket-deployment-cloudfront.js.snapshot/test-bucket-deployments-1.assets.json
diff --git a/...st/integ.bucket-deployment-cloudfront.js.snapshot/test-bucket-deployments-1.template.json b/...st/integ.bucket-deployment-cloudfront.js.snapshot/test-bucket-deployments-1.template.json
@@ -378,7 +378,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {

diff --git a/...nteg/test/aws-s3-deployment/test/integ.bucket-deployment-cloudfront.js.snapshot/tree.json b/...nteg/test/aws-s3-deployment/test/integ.bucket-deployment-cloudfront.js.snapshot/tree.json
diff --git a/...deployment-deployed-bucket.js.snapshot/test-bucket-deployment-deployed-bucket.assets.json b/...deployment-deployed-bucket.js.snapshot/test-bucket-deployment-deployed-bucket.assets.json
diff --git a/...ployment-deployed-bucket.js.snapshot/test-bucket-deployment-deployed-bucket.template.json b/...ployment-deployed-bucket.js.snapshot/test-bucket-deployment-deployed-bucket.template.json
@@ -322,7 +322,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {

diff --git a/...test/aws-s3-deployment/test/integ.bucket-deployment-deployed-bucket.js.snapshot/tree.json b/...test/aws-s3-deployment/test/integ.bucket-deployment-deployed-bucket.js.snapshot/tree.json
diff --git a/...g.bucket-deployment-signcontent.js.snapshot/test-bucket-deployment-signobject.assets.json b/...g.bucket-deployment-signcontent.js.snapshot/test-bucket-deployment-signobject.assets.json
diff --git a/...bucket-deployment-signcontent.js.snapshot/test-bucket-deployment-signobject.template.json b/...bucket-deployment-signcontent.js.snapshot/test-bucket-deployment-signobject.template.json
@@ -349,7 +349,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {

diff --git a/...teg/test/aws-s3-deployment/test/integ.bucket-deployment-signcontent.js.snapshot/tree.json b/...teg/test/aws-s3-deployment/test/integ.bucket-deployment-signcontent.js.snapshot/tree.json
diff --git a/...deployment/test/integ.bucket-deployment.js.snapshot/test-bucket-deployments-2.assets.json b/...deployment/test/integ.bucket-deployment.js.snapshot/test-bucket-deployments-2.assets.json
diff --git a/...ployment/test/integ.bucket-deployment.js.snapshot/test-bucket-deployments-2.template.json b/...ployment/test/integ.bucket-deployment.js.snapshot/test-bucket-deployments-2.template.json
@@ -411,7 +411,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {
@@ -1306,7 +1306,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {

diff --git a/...framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment.js.snapshot/tree.json b/...framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment.js.snapshot/tree.json
diff --git a/...ws-servicecatalog/test/integ.product.js.snapshot/integ-servicecatalog-product.assets.json b/...ws-servicecatalog/test/integ.product.js.snapshot/integ-servicecatalog-product.assets.json
diff --git a/...-servicecatalog/test/integ.product.js.snapshot/integ-servicecatalog-product.template.json b/...-servicecatalog/test/integ.product.js.snapshot/integ-servicecatalog-product.template.json
@@ -329,7 +329,7 @@
    "Properties": {
     "Code": {
      "S3Bucket": "cdk-hnb659fds-assets-12345678-test-region",
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {

diff --git a/...-testing/framework-integ/test/aws-servicecatalog/test/integ.product.js.snapshot/tree.json b/...-testing/framework-integ/test/aws-servicecatalog/test/integ.product.js.snapshot/tree.json
diff --git a/...catalog/test/integ.two-products.js.snapshot/integ-servicecatalog-two-products.assets.json b/...catalog/test/integ.two-products.js.snapshot/integ-servicecatalog-two-products.assets.json
diff --git a/...talog/test/integ.two-products.js.snapshot/integ-servicecatalog-two-products.template.json b/...talog/test/integ.two-products.js.snapshot/integ-servicecatalog-two-products.template.json
@@ -340,7 +340,7 @@
    "Properties": {
     "Code": {
      "S3Bucket": "cdk-hnb659fds-assets-12345678-test-region",
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {

diff --git a/...ing/framework-integ/test/aws-servicecatalog/test/integ.two-products.js.snapshot/tree.json b/...ing/framework-integ/test/aws-servicecatalog/test/integ.two-products.js.snapshot/tree.json
diff --git a/...config-alpha/test/integ.configuration.js.snapshot/aws-appconfig-configuration.assets.json b/...config-alpha/test/integ.configuration.js.snapshot/aws-appconfig-configuration.assets.json
diff --git a/...nfig-alpha/test/integ.configuration.js.snapshot/aws-appconfig-configuration.template.json b/...nfig-alpha/test/integ.configuration.js.snapshot/aws-appconfig-configuration.template.json
@@ -805,7 +805,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "e976a796f036a5efbf44b99e44cfb5a961df08d8dbf7cd37e60bf216fb982a00.zip"
+     "S3Key": "2d56e153cac88d3e0c2f842e8e6f6783b8725bf91f95e0673b4725448a56e96d.zip"
     },
     "Environment": {
      "Variables": {

diff --git a/packages/@aws-cdk/aws-appconfig-alpha/test/integ.configuration.js.snapshot/tree.json b/packages/@aws-cdk/aws-appconfig-alpha/test/integ.configuration.js.snapshot/tree.json