CDK custom resource CustomCDKBucketDeployment: SecurityHub HIGH notification: CWE-117,93 - Log injection

[eikeon]

Describe the bug

AWS Inspector reports this finding when using aws_s3_deployment.BucketDeployment

Expected Behavior

No AWS Inspector findings from aws_s3_deployment.BucketDeployment

Current Behavior

We're currently getting this one HIGH finding

Reproduction Steps

Have a CDK application that makes use of aws_s3_deployment.BucketDeployment

Possible Solution

The finding suggests the following fix:

@@ -1,2 +1,3 @@
+ with the logs
 os.putenv('AWS_CONFIG_FILE', AWS_CLI_CONFIG_FILE)
 
@@ -4,8 +5,8 @@
 
     def cfn_error(message=None):
-        logger.error("| cfn_error: %s" % message)
+        logger.error("| cfn_error: %s" % urllib.parse.quote(message))
         cfn_send(event, context, CFN_FAILED, reason=message, physicalResourceId=event.get('PhysicalResourceId', None))

Additional Information/Context

No response

CDK CLI Version

2.115.0 (build 58027ee)

Framework Version

No response

Node.js Version

v18.19.0

OS

aws/codebuild/standard:7.0

Language

TypeScript

Language Version

5.3.3

Other information

No response

[pahud]

The suggested fix from SecurityHub is from here:

aws-cdk/packages/@aws-cdk/custom-resource-handlers/lib/aws-s3-deployment/bucket-deployment-handler/index.py

Line 33 in cd54c42

logger.error("| cfn_error: %s" % message)

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.