aws-sam-cli 1.166.0__tar.gz → 1.166.2__tar.gz

{aws_sam_cli-1.166.0/aws_sam_cli.egg-info → aws_sam_cli-1.166.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-sam-cli
-Version: 1.166.0
+Version: 1.166.2
 Summary: AWS SAM CLI is a CLI tool for local development and testing of Serverless applications
 Author-email: Amazon Web Services <aws-sam-developers@amazon.com>
 License-Expression: Apache-2.0
@@ -48,7 +48,7 @@ Requires-Dist: jsonschema<4.27
 Requires-Dist: typing_extensions<5,>=4.4.0
 Requires-Dist: regex!=2021.10.8
 Requires-Dist: tzlocal==5.4.4
-Requires-Dist: cfn-lint<1.56,>=1.51.3
+Requires-Dist: cfn-lint<1.54,>=1.52.0
 Requires-Dist: boto3-stubs[apigateway,cloudformation,ecr,iam,kinesis,lambda,s3,schemas,secretsmanager,signer,sqs,stepfunctions,sts,xray]>=1.41.0
 Requires-Dist: python-dotenv<1.3,>=1.0
 Provides-Extra: rust-tests

{aws_sam_cli-1.166.0 → aws_sam_cli-1.166.2/aws_sam_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aws-sam-cli
-Version: 1.166.0
+Version: 1.166.2
 Summary: AWS SAM CLI is a CLI tool for local development and testing of Serverless applications
 Author-email: Amazon Web Services <aws-sam-developers@amazon.com>
 License-Expression: Apache-2.0
@@ -48,7 +48,7 @@ Requires-Dist: jsonschema<4.27
 Requires-Dist: typing_extensions<5,>=4.4.0
 Requires-Dist: regex!=2021.10.8
 Requires-Dist: tzlocal==5.4.4
-Requires-Dist: cfn-lint<1.56,>=1.51.3
+Requires-Dist: cfn-lint<1.54,>=1.52.0
 Requires-Dist: boto3-stubs[apigateway,cloudformation,ecr,iam,kinesis,lambda,s3,schemas,secretsmanager,signer,sqs,stepfunctions,sts,xray]>=1.41.0
 Requires-Dist: python-dotenv<1.3,>=1.0
 Provides-Extra: rust-tests

{aws_sam_cli-1.166.0 → aws_sam_cli-1.166.2}/aws_sam_cli.egg-info/requires.txt

@@ -19,7 +19,7 @@ jsonschema<4.27
 typing_extensions<5,>=4.4.0
 regex!=2021.10.8
 tzlocal==5.4.4
-cfn-lint<1.56,>=1.51.3
+cfn-lint<1.54,>=1.52.0
 boto3-stubs[apigateway,cloudformation,ecr,iam,kinesis,lambda,s3,schemas,secretsmanager,signer,sqs,stepfunctions,sts,xray]>=1.41.0
 python-dotenv<1.3,>=1.0
 

{aws_sam_cli-1.166.0 → aws_sam_cli-1.166.2}/pyproject.toml

@@ -56,7 +56,8 @@ dependencies = [
     # regex is not a direct dependency of SAM CLI, exclude version 2021.10.8 due to not working on M1 Mac
     "regex!=2021.10.8",
     "tzlocal==5.4.4",
-    "cfn-lint>=1.51.3,<1.56",
+    # Bounded to the versions that lint every SAM resource type, see #9249
+    "cfn-lint>=1.52.0,<1.54",
     "boto3-stubs[apigateway,cloudformation,ecr,iam,lambda,s3,schemas,secretsmanager,signer,stepfunctions,sts,xray,sqs,kinesis]>=1.41.0",
     "python-dotenv>=1.0,<1.3",
 ]

{aws_sam_cli-1.166.0 → aws_sam_cli-1.166.2}/samcli/__init__.py

@@ -2,4 +2,4 @@
 SAM CLI version
 """
 
-__version__ = "1.166.0"
+__version__ = "1.166.2"

{aws_sam_cli-1.166.0 → aws_sam_cli-1.166.2}/samcli/hook_packages/terraform/copy_terraform_built_artifacts.py

@@ -310,10 +310,10 @@ if __name__ == "__main__":
     argparser.add_argument(
         "--expression",
         type=str,
-        required=True,
+        required=False,
         help="Jpath query expression separated by | (delimiter) "
         "and allows for searching within a json object."
-        "eg: |values|sub_module|[?address==me]|output",
+        "eg: |values|sub_module|[?address==me]|output. Not required if --args-file is used.",
     )
     argparser.add_argument(
         "--directory",
@@ -327,6 +327,16 @@ if __name__ == "__main__":
         required=False,
         help="Terraform resource path for the SAM CLI Metadata resource. This option is not to be used with --json",
     )
+    argparser.add_argument(
+        "--args-file",
+        type=str,
+        required=False,
+        help="Path to a JSON file containing 'expression' and/or 'target' values, as an alternative to "
+        "passing them directly via --expression/--target on the command line. This avoids embedding "
+        "untrusted Terraform resource addresses/expressions in a shell command line, since quoting "
+        "rules are not portable across shells (e.g. POSIX sh vs Windows cmd.exe). Values from this "
+        "file take precedence over --expression/--target if both are provided.",
+    )
     argparser.add_argument(
         "--json",
         type=str,
@@ -347,6 +357,22 @@ if __name__ == "__main__":
     json_str = arguments.json
     mount_symlinks = arguments.mount_symlinks
 
+    if arguments.args_file:
+        try:
+            with open(arguments.args_file, "r") as args_file_handle:
+                file_args = json.load(args_file_handle)
+        except (OSError, ValueError):
+            LOG.error("Reading args file '%s' unsuccessful!", arguments.args_file, exc_info=True)
+            cli_exit()
+        if not isinstance(file_args, dict):
+            LOG.error("Args file '%s' must contain a JSON object.", arguments.args_file)
+            cli_exit()
+        expression = file_args.get("expression", expression)
+        target = file_args.get("target", target)
+
+    if not expression:
+        argparser.error("An --expression value must be provided, either directly or via --args-file.")
+
     # validate environment variables do not contain blocked arguments
     validate_environment_variables()
 

{aws_sam_cli-1.166.0 → aws_sam_cli-1.166.2}/samcli/hook_packages/terraform/hooks/prepare/enrich.py

@@ -83,6 +83,7 @@ def enrich_resources_and_generate_makefile(
     }
 
     makefile_rules = []
+    pending_args_files = []
     for sam_metadata_resource in sam_metadata_resources:
         # enrich resource
         resource_type = get_sam_metadata_planned_resource_value_attribute(
@@ -111,7 +112,7 @@ def enrich_resources_and_generate_makefile(
             )
 
             # get makefile rule for resource
-            makefile_rule = generate_makefile_rule_for_lambda_resource(
+            makefile_rule, pending_args_file = generate_makefile_rule_for_lambda_resource(
                 sam_metadata_resource,
                 logical_id,
                 terraform_application_dir,
@@ -120,10 +121,11 @@ def enrich_resources_and_generate_makefile(
                 mount_symlinks=mount_symlinks,
             )
             makefile_rules.append(makefile_rule)
+            pending_args_files.append(pending_args_file)
 
     # generate makefile
     LOG.debug("Generate Makefile in %s", output_directory_path)
-    generate_makefile(makefile_rules, output_directory_path)
+    generate_makefile(makefile_rules, pending_args_files, output_directory_path)
 
 
 def _enrich_zip_lambda_function(

{aws_sam_cli-1.166.0 → aws_sam_cli-1.166.2}/samcli/hook_packages/terraform/hooks/prepare/makefile_generator.py

@@ -4,16 +4,18 @@ Terraform Makefile and make rule generation
 This module generates the Makefile for the project and the rules for each of the Lambda functions found
 """
 
+import json
 import logging
 import os
 import shutil
 import uuid
 from pathlib import Path
-from typing import List, Optional
+from typing import List, NamedTuple, Optional, Tuple
 
 from samcli.hook_packages.terraform.hooks.prepare.types import (
     SamMetadataResource,
 )
+from samcli.lib.utils.hash import str_checksum
 from samcli.lib.utils.path_utils import convert_path_to_unix_path
 
 LOG = logging.getLogger(__name__)
@@ -21,6 +23,25 @@ LOG = logging.getLogger(__name__)
 TERRAFORM_BUILD_SCRIPT = "copy_terraform_built_artifacts.py"
 ZIP_UTILS_MODULE = "zip.py"
 TF_BACKEND_OVERRIDE_FILENAME = "z_samcli_backend_override"
+ARGS_FILE_SUFFIX = ".args.json"
+# a 16-char hex checksum plus ".args.json" is 26 characters total, comfortably clear of both the
+# 255-byte per-component filesystem/OS filename limit and Windows' 260-character MAX_PATH total
+# path length limit (see _get_args_file_path)
+ARGS_FILE_NAME_HASH_LEN = 16
+
+
+class PendingArgsFile(NamedTuple):
+    """
+    An args file (see _get_args_file_path) that still needs to be written to disk.
+
+    Building the args file's path and contents is kept separate from actually writing it, so
+    that generation of every Makefile rule can complete - and be confirmed free of errors - before
+    any file is written. See generate_makefile(), which is the only place these are written.
+    """
+
+    path: str
+    expression: str
+    target: str
 
 
 def generate_makefile_rule_for_lambda_resource(
@@ -30,7 +51,7 @@ def generate_makefile_rule_for_lambda_resource(
     python_command_name: str,
     output_dir: str,
     mount_symlinks: bool = False,
-) -> str:
+) -> Tuple[str, PendingArgsFile]:
     """
     Generates and returns a makefile rule for the lambda resource associated with the given sam metadata resource.
 
@@ -50,35 +71,50 @@ def generate_makefile_rule_for_lambda_resource(
 
     Returns
     -------
-    str
-        The generated makefile rule
+    Tuple[str, PendingArgsFile]
+        The generated makefile rule, and the args file this rule depends on. The caller is
+        responsible for passing every PendingArgsFile collected across all rules to
+        generate_makefile(), which writes them - this function itself performs no I/O.
     """
     target = _get_makefile_build_target(logical_id)
     resource_address = sam_metadata_resource.resource.get("address", "")
-    python_command_recipe = _format_makefile_recipe(
-        _build_makerule_python_command(
-            python_command_name,
-            output_dir,
-            resource_address,
-            sam_metadata_resource,
-            terraform_application_dir,
-            mount_symlinks=mount_symlinks,
-        )
+    command, pending_args_file = _build_makerule_python_command(
+        python_command_name,
+        output_dir,
+        resource_address,
+        sam_metadata_resource,
+        terraform_application_dir,
+        logical_id,
+        mount_symlinks=mount_symlinks,
     )
-    return f"{target}{python_command_recipe}"
+    python_command_recipe = _format_makefile_recipe(command)
+    return f"{target}{python_command_recipe}", pending_args_file
 
 
 def generate_makefile(
     makefile_rules: List[str],
+    pending_args_files: List[PendingArgsFile],
     output_directory_path: str,
 ) -> None:
     """
-    Generates a makefile with the given rules in the given directory
+    Generates a makefile with the given rules in the given directory, and writes the args files
+    each rule depends on.
+
+    This is the only place args files are written to disk. Collecting every PendingArgsFile
+    across all rules first, then writing them all here (rather than as each rule is built) means
+    that if generating any single rule fails partway through - e.g. an unrecognized sam metadata
+    resource type - no args file for *any* rule has been written yet, so a build that ultimately
+    fails to produce a Makefile also leaves no partial args files behind. Stale args files from a
+    previous run (e.g. for a Lambda resource that has since been renamed or removed) are pruned
+    for the same reason: nothing here is left to accumulate indefinitely across builds.
 
     Parameters
     ----------
     makefile_rules: List[str]
         the list of rules to write in the Makefile
+    pending_args_files: List[PendingArgsFile]
+        the args files that the given makefile_rules depend on; written here, after any stale
+        args files from a previous run are removed
     output_directory_path: str
         the output directory path to write the generated makefile
     """
@@ -87,6 +123,22 @@ def generate_makefile(
     if not os.path.exists(output_directory_path):
         os.makedirs(output_directory_path, exist_ok=True)
 
+    # remove any args files left behind by a previous run (e.g. for a Lambda resource that has
+    # since been renamed or removed) before writing this run's set. Listing the directory and
+    # filtering by suffix - rather than glob.glob(os.path.join(output_directory_path, "*.args.json")) -
+    # is deliberate: glob applies fnmatch pattern semantics to *every* path component, not just
+    # the final one, so a project path containing a glob metacharacter (e.g. "proj[1]") would
+    # silently make the pattern match nothing, leaving stale files to accumulate indefinitely
+    # with no error raised. os.listdir has no pattern-expansion semantics on the directory path
+    # at all, so it can't have that failure mode.
+    for entry in os.listdir(output_directory_path):
+        if entry.endswith(ARGS_FILE_SUFFIX):
+            os.remove(os.path.join(output_directory_path, entry))
+
+    for pending_args_file in pending_args_files:
+        with open(pending_args_file.path, "w+") as args_file:
+            json.dump({"expression": pending_args_file.expression, "target": pending_args_file.target}, args_file)
+
     # create z_samcli_backend_override.tf in output directory
     _generate_backend_override_file(output_directory_path)
 
@@ -130,8 +182,9 @@ def _build_makerule_python_command(
     resource_address: str,
     sam_metadata_resource: SamMetadataResource,
     terraform_application_dir: str,
+    logical_id: str,
     mount_symlinks: bool = False,
-) -> str:
+) -> Tuple[str, PendingArgsFile]:
     """
     Build the Python command recipe to be used inside of the Makefile rule
 
@@ -148,29 +201,93 @@ def _build_makerule_python_command(
         associated with this sam metadata resource
     terraform_application_dir: str
         the terraform project root directory
+    logical_id: str
+        Logical ID of the lambda resource; used to name the generated args file
 
     Returns
     -------
-    str
-        Fully resolved Terraform show command
+    Tuple[str, PendingArgsFile]
+        Fully resolved Terraform show command, and the args file it depends on (not yet written
+        to disk - see generate_makefile())
     """
     show_command_template = (
         '{python_command_name} "{terraform_built_artifacts_script_path}" '
-        '--expression "{jpath_string}" --directory "$(ARTIFACTS_DIR)" --target "{resource_address}"'
+        '--directory "$(ARTIFACTS_DIR)" --args-file "{args_file_path}"'
     )
     jpath_string = _build_jpath_string(sam_metadata_resource, resource_address)
     terraform_built_artifacts_script_path = convert_path_to_unix_path(
         str(Path(output_dir, TERRAFORM_BUILD_SCRIPT).relative_to(terraform_application_dir))
     )
+    args_file_path = _get_args_file_path(output_dir, logical_id)
+    args_file_relative_path = convert_path_to_unix_path(
+        str(Path(args_file_path).relative_to(terraform_application_dir))
+    )
     command = show_command_template.format(
         python_command_name=python_command_name,
         terraform_built_artifacts_script_path=terraform_built_artifacts_script_path,
-        jpath_string=jpath_string.replace('"', '\\"'),
-        resource_address=resource_address.replace('"', '\\"'),
+        args_file_path=args_file_relative_path,
     )
     if mount_symlinks:
         command += " --mount-symlinks"
-    return command
+    pending_args_file = PendingArgsFile(path=args_file_path, expression=jpath_string, target=resource_address)
+    return command, pending_args_file
+
+
+def _get_args_file_path(output_dir: str, logical_id: str) -> str:
+    """
+    Deterministically computes the path of the args file for a given Lambda resource, without
+    writing anything to disk - see generate_makefile(), which is where the args file content
+    (the potentially untrusted Terraform jpath expression and resource address) actually gets
+    written, once every Makefile rule has been generated successfully.
+
+    Keeping this path computation free of I/O is what lets _build_makerule_python_command (and
+    generate_makefile_rule_for_lambda_resource above it) remain pure functions of their inputs:
+    the Makefile recipe text can be built and returned - including the args file path it
+    references - without anything touching the filesystem, so a failure generating a *later*
+    rule can't leave an *earlier* rule's args file already written with nothing to clean it up.
+
+    The recipe line generated by `_build_makerule_python_command` is first macro-expanded by
+    `make`, and the result is then handed to a shell for execution (`/bin/sh` on Linux/macOS,
+    or `cmd.exe` on Windows when no `sh.exe` is found on PATH). There is no single escaping
+    scheme that is simultaneously safe for `make`'s macro expansion and portable across both
+    shells, since their quoting rules are fundamentally different (and `cmd.exe` does not treat
+    single quotes as quoting characters at all). Keeping the untrusted expression/resource
+    address off the command line entirely sidesteps the problem: only this file path (safe on
+    every shell) is ever embedded in the recipe text, and the untrusted content is read directly
+    from disk by `copy_terraform_built_artifacts.py`.
+
+    The file is named by hashing logical_id to a fixed-length string, rather than embedding (even
+    truncated) logical_id itself. logical_id is deterministic and unique per resource
+    (build_cfn_logical_id() strips every non-alphanumeric character and appends a hash of the
+    full Terraform address) but can be up to 255 *characters* and is Unicode-aware
+    ("alphanumeric" is not limited to ASCII), so a truncation-based name would have to reason
+    separately about the 255-*byte* per-component filesystem/OS filename limit and, on Windows,
+    the 260-character MAX_PATH limit on the *total* path once combined with a real project
+    directory path (MAX_PATH is hit by the project's own path depth too, not just this file name
+    in isolation, and a deeply-nested Terraform module address can push logical_id itself close
+    to 255 characters). A fixed-length hash sidesteps both regardless of how long or non-ASCII
+    logical_id is, and the deterministic name means each `sam build` (which always re-runs
+    prepare) overwrites the previous run's file for this resource, rather than accumulating one.
+
+    Note that logical_id is itself derived from the same (potentially attacker-controlled)
+    Terraform resource address that motivates this fix - hashing it is safe to embed in the
+    recipe because the hash, not the input, is what actually appears there, not because the
+    input is inherently trusted.
+
+    Parameters
+    ----------
+    output_dir: str
+        the directory into which the Makefile (and this args file) is written
+    logical_id: str
+        Logical ID of the lambda resource; hashed to name the args file
+
+    Returns
+    -------
+    str
+        The absolute path of the args file (this function does not create it)
+    """
+    args_file_name = f"{str_checksum(logical_id)[:ARGS_FILE_NAME_HASH_LEN]}{ARGS_FILE_SUFFIX}"
+    return os.path.join(output_dir, args_file_name)
 
 
 def _get_makefile_build_target(logical_id: str) -> str: