Skip to content

Commit bcb1aac

Browse files
authored
fix: Validate API request models (#1757)
1 parent 6355433 commit bcb1aac

File tree

5 files changed

+48
-3
lines changed

5 files changed

+48
-3
lines changed

samtranslator/model/eventsources/push.py

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,8 @@ class S3(PushEventSource):
218218
def resources_to_link(self, resources):
219219
if isinstance(self.Bucket, dict) and "Ref" in self.Bucket:
220220
bucket_id = self.Bucket["Ref"]
221+
if not isinstance(bucket_id, string_types):
222+
raise InvalidEventException(self.relative_id, "'Ref' value in S3 events is not a valid string.")
221223
if bucket_id in resources:
222224
return {"bucket": resources[bucket_id], "bucket_id": bucket_id}
223225
raise InvalidEventException(self.relative_id, "S3 events must reference an S3 bucket in the same template.")
@@ -657,6 +659,15 @@ def _add_swagger_integration(self, api, function, intrinsics_resolver):
657659
),
658660
)
659661

662+
if not isinstance(method_authorizer, string_types):
663+
raise InvalidEventException(
664+
self.relative_id,
665+
"Unable to set Authorizer [{authorizer}] on API method [{method}] for path [{path}] "
666+
"because it wasn't defined with acceptable values in the API's Authorizers.".format(
667+
authorizer=method_authorizer, method=self.Method, path=self.Path
668+
),
669+
)
670+
660671
if method_authorizer != "NONE" and not api_authorizers.get(method_authorizer):
661672
raise InvalidEventException(
662673
self.relative_id,
@@ -718,6 +729,14 @@ def _add_swagger_integration(self, api, function, intrinsics_resolver):
718729
model=method_model, method=self.Method, path=self.Path
719730
),
720731
)
732+
if not isinstance(method_model, string_types):
733+
raise InvalidEventException(
734+
self.relative_id,
735+
"Unable to set RequestModel [{model}] on API method [{method}] for path [{path}] "
736+
"because the related API does not contain valid Models.".format(
737+
model=method_model, method=self.Method, path=self.Path
738+
),
739+
)
721740

722741
if not api_models.get(method_model):
723742
raise InvalidEventException(
@@ -1091,7 +1110,7 @@ def _add_auth_to_openapi_integration(self, api, editor):
10911110
:param editor: OpenApiEditor object that contains the OpenApi definition
10921111
"""
10931112
method_authorizer = self.Auth.get("Authorizer")
1094-
api_auth = api.get("Auth")
1113+
api_auth = api.get("Auth", {})
10951114
if not method_authorizer:
10961115
if api_auth.get("DefaultAuthorizer"):
10971116
self.Auth["Authorizer"] = method_authorizer = api_auth.get("DefaultAuthorizer")

tests/translator/input/error_api_invalid_request_model.yaml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,3 +79,20 @@ Resources:
7979
properties:
8080
username:
8181
type: string
82+
83+
ModelIsNotString:
84+
Type: AWS::Serverless::Function
85+
Properties:
86+
CodeUri: s3://sam-demo-bucket/member_portal.zip
87+
Handler: index.gethtml
88+
Runtime: nodejs12.x
89+
Events:
90+
GetHtml:
91+
Type: Api
92+
Properties:
93+
RestApiId: !Ref MissingModelApi
94+
Path: /
95+
Method: get
96+
RequestModel:
97+
Model:
98+
- NotString

tests/translator/input/error_api_with_invalid_auth_scopes_openapi.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,12 @@ Resources:
8585
Auth:
8686
Authorizer: MyCognitoAuthWithDefaultScopes
8787
AuthorizationScopes: []
88+
CognitoAuthorizerNotString:
89+
Type: Api
90+
Properties:
91+
RestApiId: !Ref MyApiWithCognitoAuth
92+
Method: get
93+
Path: /cognitoauthorizernotstring
94+
Auth:
95+
Authorizer:
96+
- NotString
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
{
2-
"errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 5. Resource with id [MissingModelFunction] is invalid. Event with id [GetHtml] is invalid. Unable to set RequestModel [UnspecifiedModel] on API method [get] for path [/] because it wasn't defined in the API's Models. Resource with id [ModelsNotDictApi] is invalid. Invalid value for 'Models' property Resource with id [ModelsWithDefinitionUrlApi] is invalid. Models works only with inline Swagger specified in 'DefinitionBody' property. Resource with id [ModelsWithInvalidDefinitionBodyApi] is invalid. Unable to add Models definitions because 'DefinitionBody' does not contain a valid Swagger definition. Resource with id [NoModelFunction] is invalid. Event with id [GetHtml] is invalid. Unable to set RequestModel [User] on API method [get] for path [/] because the related API does not define any Models."
2+
"errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 6. Resource with id [MissingModelFunction] is invalid. Event with id [GetHtml] is invalid. Unable to set RequestModel [UnspecifiedModel] on API method [get] for path [/] because it wasn't defined in the API's Models. Resource with id [ModelIsNotString] is invalid. Event with id [GetHtml] is invalid. Unable to set RequestModel [['NotString']] on API method [get] for path [/] because the related API does not contain valid Models. Resource with id [ModelsNotDictApi] is invalid. Invalid value for 'Models' property Resource with id [ModelsWithDefinitionUrlApi] is invalid. Models works only with inline Swagger specified in 'DefinitionBody' property. Resource with id [ModelsWithInvalidDefinitionBodyApi] is invalid. Unable to add Models definitions because 'DefinitionBody' does not contain a valid Swagger definition. Resource with id [NoModelFunction] is invalid. Event with id [GetHtml] is invalid. Unable to set RequestModel [User] on API method [get] for path [/] because the related API does not define any Models."
33
}

tests/translator/output/error_api_with_invalid_auth_scopes_openapi.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,6 @@
44
"errorMessage": "Resource with id [MyApiWithCognitoAuth] is invalid. AuthorizationScopes must be a list."
55
}
66
],
7-
"errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 1. Resource with id [MyApiWithCognitoAuth] is invalid. AuthorizationScopes must be a list."
7+
"errorMessage": "Invalid Serverless Application Specification document. Number of errors found: 2. Resource with id [MyApiWithCognitoAuth] is invalid. AuthorizationScopes must be a list. Resource with id [MyFn] is invalid. Event with id [CognitoAuthorizerNotString] is invalid. Unable to set Authorizer [['NotString']] on API method [get] for path [/cognitoauthorizernotstring] because it wasn't defined with acceptable values in the API's Authorizers."
88
}
99

0 commit comments

Comments
 (0)