aws-samples / aws-samples/sample-kickstart-migration
Emails with plus signs are not properly encoded when used as request parameters in URL
- Dominant language
- TypeScript
- Stars
- 3
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
Pluses in email addresses are valid characters. Some of the API calls use the email of the user as a request parameter but do not encode plus signs. This causes the API backend to interpret the plus signs as spaces when executing the Lambda functions. Issues occur such as app owner emails not matching the records in DDB.
This issue can be replicated by creating a Cognito user with plus signs in their email address. Assigning that user to the app owner group will cause apps with matching app owner emails in DDB to not show up on the website. A user without a plus in their email address will match records in the DDB. I don't know what other side effects users with plus signs may encounter but the app owner role was most noticeable. In addition, the requests being made to the API should be visible in a browsers web dev console and the Lambda logs for certain backend functions like get_apps.
Contributor guide
Assessment
This issue has not been assessed yet.