aws / aws/aws-database-encryption-sdk-dynamodb
MPL client created without considering potential customer input
- Dominant language
- Rust
- Stars
- 40
- Forks
- 20
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 1
Description
### Issue
The MPL has a config object.
Today, that config object does not consume customer input.
But tomorrow, that could change.
Our libraries should not create instances of the top level local services,
unless we restrict the top level local services from ever consuming customer input.
_Originally posted by @texastony in https://github.com/aws/aws-database-encryption-sdk-dynamodb/pull/1507#discussion_r1887523818_
Contributor guide
Research direction
Start by tracing how the MPL client creates instances of top-level local services and how the config object is passed into them. Review the discussion referenced from pull request 1507, then determine whether those services must be prevented from consuming customer input; done means the initialization behavior is explicitly safe for future config changes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- databases, security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100