aws-sdk-sns 1.124.0 → 1.125.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ebc66c7b9e4b0f43e01c45db095f2a8c03f2271c165495cf31d0b51ef7349740
-  data.tar.gz: 6913600447c8a3e53e23d21585e7163224799240c6cdba9f31dadb2e00233fce
+  metadata.gz: 8c4de1c6e682bc02fa66c6af6759f14f18ba58cc9a1c1943380e75d26d12db4c
+  data.tar.gz: f5f754bdf50a61fe76445323b484ca3a8ee8da26be705d69f1943dd058c0e5cf
 SHA512:
-  metadata.gz: 8a16b65324c7f6b90a9df62f0e9fdb51d60fd66e98d0976d89a855bc1b9f40e941c4d22e694b6acd0f92f1522cabf43d1e3700a0656e596fb34ef840dbe51071
-  data.tar.gz: d4d0ce3df3c4e8751efddb5dd223693fdeaeea1a2f09126ec7d94e6152c4a54e46662e0515945ac6983fce206c8092ab30bd6e77e12628b380fb965e3339934f
+  metadata.gz: 642eaac779964be128f5ab179ef664d9e1330b1a5145d94190062f0a07d36e815206ef3303ec8e8707d8d640ba6b01c8e86dac86c99f868b306989897bef9162
+  data.tar.gz: e6318b84a43429767bdd750a7e4b99acda1daa9b814a370a3ee960b57618e12493aac5f2b9cd9663edd88c508b59be51479d5fdc8f6971ae50c48edb84c928c6

data/CHANGELOG.md

@@ -1,6 +1,18 @@
 Unreleased Changes
 ------------------
 
+1.125.0 (2026-10-28)
+------------------
+
+* Feature - Code Generated Changes, see `./build_tools` or `aws-sdk-core`'s CHANGELOG.md for details.
+
+* Issue - Reject SNS messages with an unsupported `Type` or malformed signed fields in `Aws::SNS::MessageVerifier`.
+
+1.124.1 (2026-10-26)
+------------------
+
+* Issue - Fix `MessageVerifier#authentic?` to return false, rather than raise, for messages that are not JSON objects or have malformed signing fields.
+
 1.124.0 (2026-10-21)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.124.0
+1.125.0

data/lib/aws-sdk-sns/client.rb

@@ -3256,7 +3256,7 @@ module Aws::SNS
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-sns'
-      context[:gem_version] = '1.124.0'
+      context[:gem_version] = '1.125.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-sns/message_verifier.rb

@@ -23,17 +23,23 @@ module Aws
 
       class VerificationError < StandardError; end
 
+      # Signable fields per message type.
       # @api private
-      SIGNABLE_KEYS = [
-        'Message',
-        'MessageId',
-        'Subject',
-        'SubscribeURL',
-        'Timestamp',
-        'Token',
-        'TopicArn',
-        'Type'
-      ].freeze
+      SIGNABLE_KEYS_BY_TYPE = {
+        'Notification' => %w[Message MessageId Subject Timestamp TopicArn Type].freeze,
+        'SubscriptionConfirmation' =>
+          %w[Message MessageId SubscribeURL Timestamp Token TopicArn Type].freeze,
+        'UnsubscribeConfirmation' =>
+          %w[Message MessageId SubscribeURL Timestamp Token TopicArn Type].freeze
+      }.freeze
+
+      # Metadata fields that must be present as non-empty strings.
+      # @api private
+      REQUIRED_KEYS = %w[MessageId Timestamp TopicArn].freeze
+
+      # Only Message may contain the newline used as the field delimiter.
+      # @api private
+      NEWLINE_SAFE_KEY = 'Message'
 
       # @api private
       AWS_HOSTNAMES = [
@@ -63,8 +69,9 @@ module Aws
       # @raise [VerificationError] Raised when the given message has failed
       #   verification.
       def authenticate!(message_body)
-        msg = Json.load(message_body)
+        msg = parse(message_body)
         msg = convert_lambda_msg(msg) if is_from_lambda(msg)
+        verify_signing_fields!(msg)
 
         case msg['SignatureVersion']
         when '1'
@@ -79,6 +86,56 @@ module Aws
 
       private
 
+      def parse(message_body)
+        msg = Json.load(message_body)
+        raise VerificationError, 'the message must be a JSON object' unless msg.is_a?(Hash)
+
+        msg
+      rescue Json::ParseError
+        raise VerificationError, 'the message is not valid JSON'
+      end
+
+      def verify_signing_fields!(msg)
+        unless msg['Signature'].is_a?(String) && msg['SigningCertURL'].is_a?(String)
+          raise VerificationError, 'the Signature and SigningCertURL must be strings'
+        end
+
+        verify_signable_fields!(msg)
+      end
+
+      def verify_signable_fields!(msg)
+        keys = SIGNABLE_KEYS_BY_TYPE[msg['Type']]
+        unless keys
+          raise VerificationError, 'the message Type is not supported'
+        end
+
+        verify_required_keys!(msg)
+        verify_field_values!(msg, keys)
+      end
+
+      def verify_required_keys!(msg)
+        REQUIRED_KEYS.each do |key|
+          value = msg[key]
+          next if value.is_a?(String) && !value.empty?
+
+          raise VerificationError, "the #{key} must be a non-empty string"
+        end
+      end
+
+      def verify_field_values!(msg, keys)
+        keys.each do |key|
+          value = msg[key]
+          next if value.nil?
+
+          unless value.is_a?(String)
+            raise VerificationError, "the #{key} must be a string"
+          end
+          if key != NEWLINE_SAFE_KEY && value.include?("\n")
+            raise VerificationError, "the #{key} must not contain newlines"
+          end
+        end
+      end
+
       def is_from_lambda(message)
         message.key? 'SigningCertUrl'
       end
@@ -114,18 +171,18 @@ module Aws
       end
 
       def canonical_string(message)
-        parts = []
-        SIGNABLE_KEYS.each do |key|
+        SIGNABLE_KEYS_BY_TYPE.fetch(message['Type']).filter_map do |key|
           value = message[key]
-          unless value.nil? or value.empty?
-            parts << "#{key}\n#{value}\n"
-          end
-        end
-        parts.join
+          "#{key}\n#{value}\n" unless value.nil? || value.empty?
+        end.join
       end
 
       def public_key(message)
-        x509_url = URI.parse(message['SigningCertURL'])
+        x509_url = begin
+          URI.parse(message['SigningCertURL'])
+        rescue URI::InvalidURIError
+          raise VerificationError, 'the SigningCertURL is not a valid URI'
+        end
         x509 = OpenSSL::X509::Certificate.new(pem(x509_url))
         OpenSSL::PKey::RSA.new(x509.public_key)
       end

data/lib/aws-sdk-sns.rb

@@ -58,7 +58,7 @@ module Aws::SNS
   autoload :Subscription, 'aws-sdk-sns/subscription'
   autoload :Topic, 'aws-sdk-sns/topic'
 
-  GEM_VERSION = '1.124.0'
+  GEM_VERSION = '1.125.0'
 
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-sns
 version: !ruby/object:Gem::Version
-  version: 1.124.0
+  version: 1.125.0
 platform: ruby
 authors:
 - Amazon Web Services
@@ -18,7 +18,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.260.0
+        version: 3.262.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -28,7 +28,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.260.0
+        version: 3.262.0
 - !ruby/object:Gem::Dependency
   name: aws-sigv4
   requirement: !ruby/object:Gem::Requirement