feat: module to ease cors configuration #831
Conversation
...ls-cors/src/main/java/software/amazon/lambda/powertools/cors/internal/CrossOriginAspect.java
Show resolved
Hide resolved
|
Converting to draft as it may be included in a larger module (cf. Python API GW handler) |
| return result; | ||
| } | ||
|
|
||
| CrossOriginHandler crossOriginHandler = new CrossOriginHandler(crossOrigin); |
There was a problem hiding this comment.
Recommendation generated by Amazon CodeGuru Reviewer. Leave feedback on this recommendation by replying to the comment or by reacting to the comment using emoji.
Problem:
This line of code lacks validation when processing input data through the following parameter: 'crossOrigin' (index: 1 | type: CrossOrigin). The parameter is exposed to external callers, because its enclosing class and method are publicly accessible. This means that upstream validation, if it exists, can be bypassed. Other validated parameters: 'pjp'. The same parameter type is validated here for example: aws-lambda-powertools-java/powertools-cors/src/main/java/software/amazon/lambda/powertools/cors/internal/CrossOriginHandler.java:43. Malicious, malformed, or unbounded inputs can cause unexpected runtime behavior or crashes, and can slow performance.
Fix:
Add checks to ensure the validity of the parameter's value, such as testing it for nullness (for example, using the @nonnull annotation as described in the Lombok library), emptiness, or equality. Or to prevent direct calls to it, reduce the method's visibility.
Learn more about potential threats and guidance from the Common Weakness Enumeration website and the OWASP Cheat Sheet series.
|
Closing for now to refocus |
Issue #, if available:
Description of changes:
This module simplifies the configuration of CORS headers when using API Gateway and Lambda proxy. It removes boilerplate code in the function itself.
Checklist
Breaking change checklist
RFC issue #:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.