aws-actions/configure-aws-credentials
1
0
Fork 0
mirror of https://github.com/aws-actions/configure-aws-credentials.git synced 2026-09-02 05:55:10 +09:00
Code Issues Packages Projects Releases Wiki Activity

feat: add regex validation to role-session-name (#1765)

Browse Source 
Previously invalid role session names would get errors from the STS
API instead of this action rejecting them, causing unnecessary retries.
Now we check them and fail early.

Closes #1656. That FR recommended that we sanitize the name before
sending to STS, but instead we error to not silently change the user's
selected session name (avoiding the potential security sharp edge)
This commit is contained in:
Tom Keller
2026-05-11 14:32:33 -07:00
committed by GitHub
parent 958a80fc34
commit e35449909c
3 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/index.test.ts
+21
View File
@@ -351,6 +351,27 @@ describe('Configure AWS Credentials', {}, () => {
await run();
expect(core.setFailed).toHaveBeenCalled();
});
it('fails with a role-session-name containing invalid characters', {}, async () => {
vi.mocked(core.getInput).mockImplementation(
mocks.getInput({ ...mocks.IAM_ASSUMEROLE_INPUTS, 'role-session-name': 'invalid session!' }),
);
await run();
expect(core.setFailed).toHaveBeenCalledWith(expect.stringContaining('Role session name is not valid'));
});
it('fails with a role-session-name that is too short', {}, async () => {
vi.mocked(core.getInput).mockImplementation(
mocks.getInput({ ...mocks.IAM_ASSUMEROLE_INPUTS, 'role-session-name': 'a' }),
);
await run();
expect(core.setFailed).toHaveBeenCalledWith(expect.stringContaining('must be between 2 and 64 characters'));
});
it('fails with a role-session-name that is too long', {}, async () => {
vi.mocked(core.getInput).mockImplementation(
mocks.getInput({ ...mocks.IAM_ASSUMEROLE_INPUTS, 'role-session-name': 'a'.repeat(65) }),
);
await run();
expect(core.setFailed).toHaveBeenCalledWith(expect.stringContaining('must be between 2 and 64 characters'));
});
it('fails if access key id is provided without secret access key', {}, async () => {
vi.mocked(core.getInput).mockImplementation(
mocks.getInput({ ...mocks.IAM_USER_INPUTS, 'aws-secret-access-key': '' }),