Skip to content

CDK custom resource CustomCDKBucketDeployment: SecurityHub HIGH notification: CWE-117,93 - Log injection #28469

@eikeon

Description

@eikeon

Describe the bug

AWS Inspector reports this finding when using aws_s3_deployment.BucketDeployment

Expected Behavior

No AWS Inspector findings from aws_s3_deployment.BucketDeployment

Current Behavior

We're currently getting this one HIGH finding

Reproduction Steps

Have a CDK application that makes use of aws_s3_deployment.BucketDeployment

Possible Solution

The finding suggests the following fix:

@@ -1,2 +1,3 @@
+ with the logs
 os.putenv('AWS_CONFIG_FILE', AWS_CLI_CONFIG_FILE)
 
@@ -4,8 +5,8 @@
 
     def cfn_error(message=None):
-        logger.error("| cfn_error: %s" % message)
+        logger.error("| cfn_error: %s" % urllib.parse.quote(message))
         cfn_send(event, context, CFN_FAILED, reason=message, physicalResourceId=event.get('PhysicalResourceId', None))

Additional Information/Context

No response

CDK CLI Version

2.115.0 (build 58027ee)

Framework Version

No response

Node.js Version

v18.19.0

OS

aws/codebuild/standard:7.0

Language

TypeScript

Language Version

5.3.3

Other information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions