aws-activejob-sqs 1.0.2 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 43f56ad87999ca924172fa56bb7fb6af16e77a0e63ed63cf77398e8ab097da7e
-  data.tar.gz: 10b9fbb6d8583041306da87e6186e7ec67607f975b33242695080441db7a4ce3
+  metadata.gz: d1b770d150d33bd540df6ee1c10c1546ccd93590d7ad09706856e60f6b6cae47
+  data.tar.gz: 38cb019b97c6b630d396116b105a6c8df30c9f16318cf82cccd25f8f85fef587
 SHA512:
-  metadata.gz: ed23b76c320bc0cf8860b9df133fd114fb62f5439dbca3eaacf927ffd6c30b7cf4eb2df05e74bacc1a79d56ffce1f77a6052a22c3ffd51fd1d7405c1bb29b45c
-  data.tar.gz: 0ceaf002ad0b8ef3246df38b8570b2bbab13de7b53346dc8fefb49b964bd2d6db96fcc2a0f86c0c852048daee0202e2b8947f55267eab0f1a4c0a547d697c942
+  metadata.gz: 8a4fe7cc814506be5d6b667e44150c5abf6fd7badfaa565fc448bb976380e16ac594abc601333571faebc6ac964c885a98eebb67722476885f9f4d8d2ca01282
+  data.tar.gz: b4986768479fb9e0a92db2769a3a19b576184bcefe6491abe4aa501568d9aa8672988847587741cf391e4062d514a5f85a66f45919bdb7a8e13c8ebf026f7066

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+1.1.0 (2026-08-11)
+------------------
+
+* Issue - Raise a clear error at enqueue time when a delayed job targets a FIFO queue, which does not support per-message delays (#36).
+* Issue - Only classes inheriting from `ActiveJob::Base` are executed by the poller, preventing arbitrary classes named in an SQS message from being instantiated and run. Job class names are validated as constant paths and resolved without searching the namespace's ancestors, so a message cannot name a constant outside the intended namespace.
+* Feature - Add optional `job_class_allowlist` configuration to restrict which job classes can be dispatched. Configurable in code, the config YAML file, or via the `AWS_ACTIVE_JOB_SQS_JOB_CLASS_ALLOWLIST` environment variable. When set, the allowlist is checked before the class name is resolved, so an excluded class is never loaded.
+
 1.0.2 (2025-04-01)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.0.2
+1.1.0

data/lib/active_job/queue_adapters/sqs_adapter.rb

@@ -21,6 +21,7 @@ module ActiveJob
 
       def enqueue_at(job, timestamp)
         delay = Params.assured_delay_seconds(timestamp)
+        validate_fifo_delay!(job, delay)
         _enqueue(job, nil, delay_seconds: delay)
       end
 
@@ -45,22 +46,40 @@ module ActiveJob
       end
 
       def enqueue_batch(queue_url, chunk)
-        entries = chunk.map do |job|
-          entry = Params.new(job, nil).entry
-          entry[:id] = job.job_id
-          entry[:delay_seconds] = Params.assured_delay_seconds(job.scheduled_at) if job.scheduled_at
-          entry
-        end
-
         send_message_opts = {
           queue_url: queue_url,
-          entries: entries
+          entries: chunk.map { |job| batch_entry(job) }
         }
 
         send_message_batch_result = Aws::ActiveJob::SQS.config.client.send_message_batch(send_message_opts)
         send_message_batch_result.successful.count
       end
 
+      def batch_entry(job)
+        entry = Params.new(job, nil).entry
+        entry[:id] = job.job_id
+        if job.scheduled_at
+          delay = Params.assured_delay_seconds(job.scheduled_at)
+          validate_fifo_delay!(job, delay)
+          entry[:delay_seconds] = delay
+        end
+        entry
+      end
+
+      # SQS FIFO queues do not support per-message delays
+      def validate_fifo_delay!(job, delay)
+        return unless delay.positive?
+
+        queue_url = Aws::ActiveJob::SQS.config.url_for(job.queue_name)
+        return unless Aws::ActiveJob::SQS.fifo?(queue_url)
+
+        err_msg =
+          "FIFO queue #{queue_url} does not support per-message delays " \
+          '(e.g. `set(wait:)`, `enqueue_at` or `retry_on wait:`). ' \
+          'When using `retry_on` with FIFO queues, set `wait: 0`.'
+        raise Aws::ActiveJob::SQS::FifoDelayNotSupportedError, err_msg
+      end
+
       def _enqueue(job, body = nil, send_message_opts = {})
         body ||= job.serialize
         params = Params.new(job, body)

data/lib/aws/active_job/sqs/configuration.rb

@@ -69,6 +69,7 @@ module Aws
           shutdown_timeout
           visibility_timeout
           message_group_id
+          job_class_allowlist
         ].freeze
 
         QUEUE_ENV_CONFIGS = %i[
@@ -81,7 +82,7 @@ module Aws
         QUEUE_CONFIGS = QUEUE_ENV_CONFIGS + %i[excluded_deduplication_keys]
 
         QUEUE_KEY_REGEX =
-          /AWS_ACTIVE_JOB_SQS_([\w]+)_(#{QUEUE_ENV_CONFIGS.map(&:upcase).join('|')})/.freeze
+          /AWS_ACTIVE_JOB_SQS_(\w+)_(#{QUEUE_ENV_CONFIGS.map(&:upcase).join('|')})/.freeze
 
         # Don't use this method directly: Configuration is a singleton class,
         # use {Aws::ActiveJob::SQS.config Aws::ActiveJob::SQS.config}
@@ -148,6 +149,13 @@ module Aws
         # @option options [Array] :excluded_deduplication_keys (['job_id'])
         #   The type of keys stored in the array should be String or Symbol.
         #   Using this option, job_id is implicitly added to the keys.
+        #
+        # @option options [Array<Class, String>, String, nil] :job_class_allowlist (nil)
+        #   An optional list of job classes permitted to be executed. When set,
+        #   only classes in this list are dispatched; when nil, any class
+        #   inheriting from ActiveJob::Base is allowed. Entries may be Class
+        #   objects or class name Strings (in code/YAML), or a comma-separated
+        #   String of class names (from ENV), and are compared by class name.
 
         def initialize(options = {})
           opts = env_options.deep_merge(options)
@@ -160,7 +168,8 @@ module Aws
         # @api private
         attr_accessor :queues, :threads, :backpressure,
                       :shutdown_timeout, :logger,
-                      :async_queue_error_handler
+                      :async_queue_error_handler,
+                      :job_class_allowlist
 
         # @api private
         attr_writer :max_messages, :message_group_id, :visibility_timeout,

data/lib/aws/active_job/sqs/errors.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Aws
+  module ActiveJob
+    module SQS
+      # Raised when a job with a positive delay is enqueued to a FIFO queue.
+      class FifoDelayNotSupportedError < StandardError; end
+    end
+  end
+end

data/lib/aws/active_job/sqs/executor.rb

@@ -91,13 +91,30 @@ module Aws
           job.run
           message.delete
         rescue JSON::ParserError => e
-          @logger.error "Unable to parse message body: #{message.data.body}. Error: #{e}."
+          # An unparseable body is a permanent failure: the message content is
+          # immutable, so re-parsing it on redelivery can never succeed. Log and
+          # delete it so it does not redeliver indefinitely.
+          drop_permanent_failure(message, "Unable to parse message body: #{message.data.body}. Error: #{e}.")
+        rescue InvalidJobClassError => e
+          # A bad job class is a permanent failure: redelivering it can never
+          # succeed and, on the default config, would crash-loop the poller.
+          # Log the forensic detail (the message can't be inspected in a DLQ
+          # once deleted) and delete it so it does not redeliver.
+          drop_permanent_failure(message, "Rejecting message #{message.message_id}: #{e}. " \
+                                          "Body: #{message.data.body}. Deleting so it does not redeliver.")
         rescue StandardError => e
           handle_standard_error(e, job, message)
         ensure
           @task_complete.set
         end
 
+        # Log a permanently-failed message and delete it so SQS does not
+        # redeliver it (which, on the default config, would crash-loop the poller).
+        def drop_permanent_failure(message, log_message)
+          @logger.error log_message
+          message.delete
+        end
+
         def handle_standard_error(error, job, message)
           job_msg = job ? "#{job.id}[#{job.class_name}]" : 'unknown job'
           @logger.info "Error processing job #{job_msg}: #{error}"

data/lib/aws/active_job/sqs/job_runner.rb

@@ -3,13 +3,26 @@
 module Aws
   module ActiveJob
     module SQS
+      # Raised when a message names a job class that cannot be executed: the
+      # name is not a well-formed constant path, it is not in the configured
+      # job_class_allowlist, it is undefined, or it does not name a class
+      # inheriting from ActiveJob::Base. This is a permanent
+      # failure: such a message can never succeed, so the executor logs and
+      # deletes it rather than letting it redeliver.
+      class InvalidJobClassError < StandardError; end
+
       # @api private
       class JobRunner
+        # A job class name is an (optionally namespaced) constant path and
+        # nothing else. Names that cannot match this can never name a job
+        # class, so rejecting them keeps them out of the constant lookup.
+        JOB_CLASS_NAME_PATTERN = /\A[A-Z]\w*(::[A-Z]\w*)*\z/.freeze
+
         attr_reader :id, :class_name
 
         def initialize(message)
           @job_data = ActiveSupport::JSON.load(message.data.body)
-          @class_name = @job_data['job_class'].constantize
+          @class_name = resolve_job_class(@job_data['job_class'])
           @id = @job_data['job_id']
         end
 
@@ -21,6 +34,53 @@ module Aws
           @job_data['exception_executions'] &&
             !@job_data['exception_executions'].empty?
         end
+
+        private
+
+        # Checks are ordered so that the least trusting one runs first. Merely
+        # resolving a constant is not inert: in Rails it triggers autoloading,
+        # which runs the body of whichever file defines it. So the name is
+        # matched against the allowlist as a String, before any lookup, and an
+        # excluded name never reaches the constant resolver at all.
+        def resolve_job_class(name)
+          name = name.to_s
+          unless JOB_CLASS_NAME_PATTERN.match?(name)
+            raise InvalidJobClassError, "#{name.inspect} is not a valid job class name"
+          end
+
+          allowlist = normalized_allowlist
+          if allowlist && !allowlist.include?(name)
+            raise InvalidJobClassError, "#{name} is not in the configured job_class_allowlist"
+          end
+
+          klass = constantize_job_class(name)
+          unless klass.is_a?(Class) && klass < ::ActiveJob::Base
+            raise InvalidJobClassError, "#{name} is not a valid job class (must inherit from ActiveJob::Base)"
+          end
+
+          klass
+        end
+
+        # Resolves an already-validated name. +inherit+ is false so that each
+        # segment must be defined directly on the preceding one: a name such
+        # as 'SomeJob::Foo' cannot resolve Foo from SomeJob's ancestors when
+        # SomeJob itself does not define it. NameError is treated as a
+        # rejection rather than propagated: an unknown class is the same
+        # permanent failure as a disallowed one.
+        def constantize_job_class(name)
+          Object.const_get(name, false)
+        rescue NameError
+          raise InvalidJobClassError, "#{name} is not defined"
+        end
+
+        # The allowlist may be configured as an Array of Class values (in code),
+        # an Array of Strings (from the YAML file), or a comma-separated String
+        # (from ENV). Normalize all forms to an Array of class name Strings.
+        def normalized_allowlist
+          allowlist = Aws::ActiveJob::SQS.config.job_class_allowlist
+          allowlist = allowlist.split(',') if allowlist.is_a?(String)
+          allowlist&.map { |entry| entry.to_s.strip }
+        end
       end
     end
   end

data/lib/aws-activejob-sqs.rb

@@ -4,6 +4,7 @@ require 'active_job'
 require_relative 'active_job/queue_adapters/sqs_adapter'
 require_relative 'active_job/queue_adapters/sqs_adapter/params'
 require_relative 'active_job/queue_adapters/sqs_async_adapter'
+require_relative 'aws/active_job/sqs/errors'
 require_relative 'aws/active_job/sqs/configuration'
 require_relative 'aws/active_job/sqs/deduplication'
 require_relative 'aws/active_job/sqs/executor'
@@ -16,24 +17,26 @@ module Aws
     module SQS
       VERSION = File.read(File.expand_path('../VERSION', __dir__)).strip
 
-      # @return [Configuration] the (singleton) Configuration
-      def self.config
-        @config ||= Configuration.new
-      end
+      class << self
+        # @return [Configuration] the (singleton) Configuration
+        def config
+          @config ||= Configuration.new
+        end
 
-      # @yield [Configuration] the (singleton) Configuration
-      def self.configure
-        yield(config)
-      end
+        # @yield [Configuration] the (singleton) Configuration
+        def configure
+          yield(config)
+        end
 
-      # @param queue_url [String]
-      # @return [Boolean] true if the queue_url is a FIFO queue
-      def self.fifo?(queue_url)
-        queue_url.end_with?('.fifo')
-      end
+        # @param queue_url [String]
+        # @return [Boolean] true if the queue_url is a FIFO queue
+        def fifo?(queue_url)
+          queue_url.end_with?('.fifo')
+        end
 
-      def self.on_worker_stop(...)
-        Executor.on_stop(...)
+        def on_worker_stop(...)
+          Executor.on_stop(...)
+        end
       end
     end
   end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: aws-activejob-sqs
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.1.0
 platform: ruby
 authors:
 - Amazon Web Services
 bindir: bin
 cert_chain: []
-date: 2025-04-01 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-sqs
@@ -76,6 +76,7 @@ files:
 - lib/aws/active_job/sqs/cli_options.rb
 - lib/aws/active_job/sqs/configuration.rb
 - lib/aws/active_job/sqs/deduplication.rb
+- lib/aws/active_job/sqs/errors.rb
 - lib/aws/active_job/sqs/executor.rb
 - lib/aws/active_job/sqs/job_runner.rb
 - lib/aws/active_job/sqs/lambda_handler.rb
@@ -98,7 +99,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.5
+rubygems_version: 4.0.16
 specification_version: 4
 summary: ActiveJob integration with SQS
 test_files: []