aws / aws/aws-database-encryption-sdk-dynamodb

MPL client created without considering potential customer input

Open
#1,510 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
40
Forks
20
Avg merge
1d 17h
Merged PRs (30d)
1

Description

### Issue
The MPL has a config object.
Today, that config object does not consume customer input.

But tomorrow, that could change.

Our libraries should not create instances of the top level local services,
unless we restrict the top level local services from ever consuming customer input.

_Originally posted by @texastony in https://github.com/aws/aws-database-encryption-sdk-dynamodb/pull/1507#discussion_r1887523818_

Contributor guide

Open the contributing guide

Research direction

Start by tracing how the MPL client creates instances of top-level local services and how the config object is passed into them. Review the discussion referenced from pull request 1507, then determine whether those services must be prevented from consuming customer input; done means the initialization behavior is explicitly safe for future config changes.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
databases, security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.