Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upfix for _generate_arn() in AuthResponse #1212
Conversation
CustomAuthorizer fails when querystring params contain : or /
If the user passes pathParams that contain : or / and the Chalice app uses a CustomAuthorizer then the incoming_arn will be incorrect. Adding .split('?')[0] fixes this issue.
codecov-io
commented
Aug 13, 2019
Codecov Report
@@ Coverage Diff @@
## master #1212 +/- ##
=======================================
Coverage 95.98% 95.98%
=======================================
Files 28 28
Lines 5176 5176
Branches 658 658
=======================================
Hits 4968 4968
Misses 135 135
Partials 73 73
Continue to review full report at Codecov.
|
anthonygrant
changed the title
|
Thanks for the PR. Can you add test cases for this please? There is also the case where the API Gateway itself has a ? in the name where this code won't work. Can you add a test case for that as well. |
|
Thanks @stealthycoin . I'll look to create some tests soon. Can you be specific about the case where there would be a ? in the API Gateway in the name. I was thinking you might mean a custom domain name but a quick search confirms that that character is illegal so I think I'm looking in the wrong direction. Can you help me here so I can make sure my solution works in all situations and the tests can confirm that outcome. |
|
Ah, I don't think its illegal. I made an api gateway API with ? in its name. |
anthonygrant commentedAug 13, 2019
•
edited
CustomAuthorizer fails when querystring params contain : or /
If the user passes pathParams that contain : or / and the Chalice app uses a CustomAuthorizer then the incoming_arn will be incorrect. Adding .split('?')[0] fixes this issue.
Issue #, if available:
#1211
Description of changes:
The _generate_arn function in AuthResponse will fail to create the propper arn if querystring parameters are passed that contain
:or/. This change simply removes the querystring portion of the url before generating the arn.