AWS glue medium security documentation change
Summary
Updated multiple custom string pattern regular expressions for input validation
Security assessment
Several regex patterns were tightened to enforce stricter validation (e.g., pattern #29 now validates AWS KMS ARN formats across partitions, pattern #53 restricts allowed characters to prevent potential injection attacks, pattern #61 removes newline characters). These changes improve security by preventing malformed or malicious input that could lead to injection vulnerabilities or misconfigurations.
Diff
diff --git a/glue/latest/dg/aws-glue-api-common.md b/glue/latest/dg/aws-glue-api-common.md index b039f7651..3acbf412b 100644 --- a//glue/latest/dg/aws-glue-api-common.md +++ b//glue/latest/dg/aws-glue-api-common.md @@ -427 +427 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #29 – "`arn:aws:kms:.*`" + * Custom string pattern #29 – "`^$|arn:aws[a-z0-9-]*:kms:.*`" @@ -453 +453 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #42 – "`^$|arn:aws[a-z0-9-]*:kms:.*`" + * Custom string pattern #42 – "`^subnet-[a-z0-9]+$`" @@ -455 +455 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #43 – "`^subnet-[a-z0-9]+$`" + * Custom string pattern #43 – "`[\p{L}\p{N}\p{P}]*`" @@ -457 +457 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #44 – "`[\p{L}\p{N}\p{P}]*`" + * Custom string pattern #44 – "`[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`" @@ -459 +459 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #45 – "`[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`" + * Custom string pattern #45 – "`[a-zA-Z0-9-_$#.]+`" @@ -461 +461 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #46 – "`[a-zA-Z0-9-_$#.]+`" + * Custom string pattern #46 – "`^\d{12}$`" @@ -463 +463 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #47 – "`^\d{12}$`" + * Custom string pattern #47 – "`^(\w+\.)+\w+$`" @@ -465 +465 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #48 – "`^(\w+\.)+\w+$`" + * Custom string pattern #48 – "`^([2-3]|3[.]9)$`" @@ -467 +467 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #49 – "`^([2-3]|3[.]9)$`" + * Custom string pattern #49 – "`arn:aws(-(cn|us-gov|iso(-[bef])?))?:glue:.*`" @@ -469 +469 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #50 – "`arn:aws(-(cn|us-gov|iso(-[bef])?))?:glue:.*`" + * Custom string pattern #50 – "`(^arn:aws(-(cn|us-gov|iso(-[bef])?))?:iam::\w{12}:root)`" @@ -471 +471 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #51 – "`(^arn:aws(-(cn|us-gov|iso(-[bef])?))?:iam::\w{12}:root)`" + * Custom string pattern #51 – "`^arn:aws(-(cn|us-gov|iso(-[bef])?))?:iam::[0-9]{12}:role/.+`" @@ -473 +473 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #52 – "`^arn:aws(-(cn|us-gov|iso(-[bef])?))?:iam::[0-9]{12}:role/.+`" + * Custom string pattern #52 – "`[\s\S]*`" @@ -475 +475 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #53 – "`[\s\S]*`" + * Custom string pattern #53 – "`([\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF]|[^\S\r\n"'= ;])*`" @@ -477 +477 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #54 – "`([\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF]|[^\S\r\n"'= ;])*`" + * Custom string pattern #54 – "`^[A-Z\_]+$`" @@ -479 +479 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #55 – "`^[A-Z\_]+$`" + * Custom string pattern #55 – "`^[A-Za-z0-9]+$`" @@ -481 +481 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #56 – "`^[A-Za-z0-9]+$`" + * Custom string pattern #56 – "`[*A-Za-z0-9_-]*`" @@ -483 +483 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #57 – "`[*A-Za-z0-9_-]*`" + * Custom string pattern #57 – "`([\u0020-\u007E\r\s\n])*`" @@ -485 +485 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #58 – "`([\u0020-\u007E\r\s\n])*`" + * Custom string pattern #58 – "`[A-Za-z0-9_-]*`" @@ -487 +487 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #59 – "`[A-Za-z0-9_-]*`" + * Custom string pattern #59 – "`([\u0009\u000B\u000C\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF])*`" @@ -489 +489 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #60 – "`([\u0009\u000B\u000C\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF])*`" + * Custom string pattern #60 – "`([\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF\s])*`" @@ -491,3 +491 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #61 – "`([\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF\s])*`" - - * Custom string pattern #62 – "`([^\r\n])*`" + * Custom string pattern #61 – "`([^\r\n])*`"