Package com.amazonaws.serverless.proxy.internal

Class SecurityUtils

java.lang.Object

com.amazonaws.serverless.proxy.internal.SecurityUtils

public final class SecurityUtils
extends Object

This class contains utility methods to address FSB security issues found in the application, such as string sanitization and file path validation.

Constructor Summary

Constructors

Constructor	Description
SecurityUtils()

Method Summary

Modifier and Type	Method	Description
static String	crlf(String s)	Replaces CRLF characters in a string with empty string ("").
static String	encode(String s)	Escapes all special characters in a java string
static String	getValidFilePath(String inputPath)
static String	getValidFilePath(String inputPath, boolean isWrite)	Returns an absolute file path given an input path and validates that it is not trying to write/read from a directory other than /tmp.
static boolean	isValidHost(String host, String apiId, AlbContext elb, String region)
static boolean	isValidPort(String port)
static boolean	isValidScheme(String scheme)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SecurityUtils

public SecurityUtils()

Method Details

isValidPort

public static boolean isValidPort(String port)

isValidScheme

public static boolean isValidScheme(String scheme)

isValidHost

public static boolean isValidHost(String host,
 String apiId,
 AlbContext elb,
 String region)

crlf

public static String crlf(String s)

Replaces CRLF characters in a string with empty string ("").

Parameters:

s - The string to be cleaned

Returns:

A copy of the original string without CRLF characters

encode

public static String encode(String s)

Escapes all special characters in a java string

Parameters:

s - The string to be cleaned

Returns:

The escaped string

getValidFilePath

public static String getValidFilePath(String inputPath)

getValidFilePath

public static String getValidFilePath(String inputPath,
 boolean isWrite)

Returns an absolute file path given an input path and validates that it is not trying to write/read from a directory other than /tmp. We suppress the path traversal warnings because this method is used to validate paths passed to the servlet implementation methods such as AwsProxyRequestPart.write(String). Using relative paths is a valid use-case for developers implementing a servlet-based API. We mitigate the potential partial path traversal by checking the resulting absolute path against the list of allowed paths specified in ContainerConfig.getValidFilePaths(). We also block the /var/task directory regardless.

Parameters:

inputPath - The input path

Returns:

The absolute path to the file

Throws:

IllegalArgumentException - If the given path is not valid or outside of /tmp