aws-sdk-sns 1.124.1 → 1.125.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 350723b85a653546a5a98dbe7f577f11daa1e25e655386d50d8bb50da2ea5491
-  data.tar.gz: 5dd7a46c16b649dd60674ed6ed2e55323d5f6145d2ae04c12b58d20d724caa35
+  metadata.gz: 8c4de1c6e682bc02fa66c6af6759f14f18ba58cc9a1c1943380e75d26d12db4c
+  data.tar.gz: f5f754bdf50a61fe76445323b484ca3a8ee8da26be705d69f1943dd058c0e5cf
 SHA512:
-  metadata.gz: c6b19873cfd6576f3b461d5decb370ee6a906a39c422528fa8418ab672cec6de2e12158636fb97ce15cdaf1c5c012e67de66b2288c8bb8bc2d75353be7070039
-  data.tar.gz: 30b7f6360670515c3e748bf29c30f1c2de38e76bbd17bc296a2332132aed17f63220ba2032e1d528c6105af015d55fe5f2df697e511837801cd051026db23830
+  metadata.gz: 642eaac779964be128f5ab179ef664d9e1330b1a5145d94190062f0a07d36e815206ef3303ec8e8707d8d640ba6b01c8e86dac86c99f868b306989897bef9162
+  data.tar.gz: e6318b84a43429767bdd750a7e4b99acda1daa9b814a370a3ee960b57618e12493aac5f2b9cd9663edd88c508b59be51479d5fdc8f6971ae50c48edb84c928c6

data/CHANGELOG.md

@@ -1,6 +1,13 @@
 Unreleased Changes
 ------------------
 
+1.125.0 (2026-10-28)
+------------------
+
+* Feature - Code Generated Changes, see `./build_tools` or `aws-sdk-core`'s CHANGELOG.md for details.
+
+* Issue - Reject SNS messages with an unsupported `Type` or malformed signed fields in `Aws::SNS::MessageVerifier`.
+
 1.124.1 (2026-10-26)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.124.1
+1.125.0

data/lib/aws-sdk-sns/client.rb

@@ -3256,7 +3256,7 @@ module Aws::SNS
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-sns'
-      context[:gem_version] = '1.124.1'
+      context[:gem_version] = '1.125.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-sns/message_verifier.rb

@@ -23,17 +23,23 @@ module Aws
 
       class VerificationError < StandardError; end
 
+      # Signable fields per message type.
       # @api private
-      SIGNABLE_KEYS = [
-        'Message',
-        'MessageId',
-        'Subject',
-        'SubscribeURL',
-        'Timestamp',
-        'Token',
-        'TopicArn',
-        'Type'
-      ].freeze
+      SIGNABLE_KEYS_BY_TYPE = {
+        'Notification' => %w[Message MessageId Subject Timestamp TopicArn Type].freeze,
+        'SubscriptionConfirmation' =>
+          %w[Message MessageId SubscribeURL Timestamp Token TopicArn Type].freeze,
+        'UnsubscribeConfirmation' =>
+          %w[Message MessageId SubscribeURL Timestamp Token TopicArn Type].freeze
+      }.freeze
+
+      # Metadata fields that must be present as non-empty strings.
+      # @api private
+      REQUIRED_KEYS = %w[MessageId Timestamp TopicArn].freeze
+
+      # Only Message may contain the newline used as the field delimiter.
+      # @api private
+      NEWLINE_SAFE_KEY = 'Message'
 
       # @api private
       AWS_HOSTNAMES = [
@@ -93,6 +99,41 @@ module Aws
         unless msg['Signature'].is_a?(String) && msg['SigningCertURL'].is_a?(String)
           raise VerificationError, 'the Signature and SigningCertURL must be strings'
         end
+
+        verify_signable_fields!(msg)
+      end
+
+      def verify_signable_fields!(msg)
+        keys = SIGNABLE_KEYS_BY_TYPE[msg['Type']]
+        unless keys
+          raise VerificationError, 'the message Type is not supported'
+        end
+
+        verify_required_keys!(msg)
+        verify_field_values!(msg, keys)
+      end
+
+      def verify_required_keys!(msg)
+        REQUIRED_KEYS.each do |key|
+          value = msg[key]
+          next if value.is_a?(String) && !value.empty?
+
+          raise VerificationError, "the #{key} must be a non-empty string"
+        end
+      end
+
+      def verify_field_values!(msg, keys)
+        keys.each do |key|
+          value = msg[key]
+          next if value.nil?
+
+          unless value.is_a?(String)
+            raise VerificationError, "the #{key} must be a string"
+          end
+          if key != NEWLINE_SAFE_KEY && value.include?("\n")
+            raise VerificationError, "the #{key} must not contain newlines"
+          end
+        end
       end
 
       def is_from_lambda(message)
@@ -130,14 +171,10 @@ module Aws
       end
 
       def canonical_string(message)
-        parts = []
-        SIGNABLE_KEYS.each do |key|
+        SIGNABLE_KEYS_BY_TYPE.fetch(message['Type']).filter_map do |key|
           value = message[key]
-          unless value.nil? or value.empty?
-            parts << "#{key}\n#{value}\n"
-          end
-        end
-        parts.join
+          "#{key}\n#{value}\n" unless value.nil? || value.empty?
+        end.join
       end
 
       def public_key(message)

data/lib/aws-sdk-sns.rb

@@ -58,7 +58,7 @@ module Aws::SNS
   autoload :Subscription, 'aws-sdk-sns/subscription'
   autoload :Topic, 'aws-sdk-sns/topic'
 
-  GEM_VERSION = '1.124.1'
+  GEM_VERSION = '1.125.0'
 
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-sns
 version: !ruby/object:Gem::Version
-  version: 1.124.1
+  version: 1.125.0
 platform: ruby
 authors:
 - Amazon Web Services
@@ -18,7 +18,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.260.0
+        version: 3.262.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -28,7 +28,7 @@ dependencies:
         version: '3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.260.0
+        version: 3.262.0
 - !ruby/object:Gem::Dependency
   name: aws-sigv4
   requirement: !ruby/object:Gem::Requirement