awslabs / awslabs/serverless-rules

ApiGatewayStructuredLoggingRule and LambdaStarPermissionRule validation failures with malformed input

Open
#232 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
420
Forks
29
PR merge metrics
No merged PRs in 30d

Description

**What were you trying to accomplish?**
I was using cfn-lint with the serverless rules plugin to validate CloudFormation templates containing API Gateway configurations with structured logging and Lambda functions with IAM roles and policies.

## Expected Behavior
The ApiGatewayStructuredLoggingRule should properly validate log format strings even when they contain leading/trailing quotes or whitespace. The LambdaStarPermissionRule should handle IAM policy documents gracefully even when statements or principals are not properly formatted as dictionaries.

## Current Behavior
* ApiGatewayStructuredLoggingRule: The rule fails to validate log format strings that contain leading/trailing quotes or whitespace, incorrectly flagging valid JSON log formats as invalid
* LambdaStarPermissionRule: The rule crashes or produces false positives when encountering malformed IAM policy documents where statements or principals are not properly structured as dictionaries

## Possible Solution
The rules need enhanced input validation and sanitization:
* Strip leading/trailing quotes and whitespace from log format strings before JSON validation
* Add type checking to ensure statements and principals are dictionaries before accessing their properties
* Implement defensive programming practices to handle edge cases in policy document structures

## Steps to Reproduce (for bugs)

1. Create a CloudFormation template with API Gateway stage containing structured logging
2. Use a log format string with leading/trailing quotes or whitespace
3. Create a CloudFormation template with Lambda function and IAM role
4. Include malformed IAM policy documents with non-dictionary statements or principals
5. Run cfn-lint with the serverless rules plugin
6. Observe validation failures or crashes

## Environment

* **Infrastructure as code technology used**:
* **(for `cfn-lint`) Python, cfn-lint, and cfn-lint-serverless versions**: 1.34.1
* **(for `tflint`) Go, tflint versions**: N/A

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.