Skip to content

Commit 9801e27

Browse files
pulimsrpulimsr
committed
Region Parameter Validation
1 parent e0de583 commit 9801e27

File tree

7 files changed

+331
-0
lines changed

7 files changed

+331
-0
lines changed

‎tests/aws-cpp-sdk-sns-integration-tests/SSRFProtectionTest.cpp‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#include <gtest/gtest.h>
2+
#include <aws/testing/AwsTestHelpers.h>
3+
#include <aws/core/client/ClientConfiguration.h>
4+
#include <aws/core/Aws.h>
5+
#include <aws/sns/SNSClient.h>
6+
#include <aws/sns/model/ListTopicsRequest.h>
7+
8+
using namespace Aws;
9+
using namespace Aws::SNS;
10+
using namespace Aws::SNS::Model;
11+
12+
namespace
13+
{
14+
static const char ALLOCATION_TAG[] = "SSRFProtectionTest";
15+
16+
class SSRFProtectionTest : public ::testing::Test
17+
{
18+
protected:
19+
void SetUp() override
20+
{
21+
Aws::InitAPI(options);
22+
}
23+
24+
void TearDown() override
25+
{
26+
Aws::ShutdownAPI(options);
27+
}
28+
29+
Aws::SDKOptions options;
30+
};
31+
32+
TEST_F(SSRFProtectionTest, TestSNSClientRejectsMaliciousRegion)
33+
{
34+
// Test malicious region with @ character that could redirect to attacker.com
35+
Aws::Client::ClientConfiguration config;
36+
config.region = "@attacker.com#";
37+
38+
// SNS client should reject this malicious region
39+
auto snsClient = Aws::MakeShared<SNSClient>(ALLOCATION_TAG, config);
40+
41+
// Try to make a request - this should fail safely
42+
ListTopicsRequest request;
43+
auto outcome = snsClient->ListTopics(request);
44+
45+
// The request should fail (not redirect to attacker.com)
46+
EXPECT_FALSE(outcome.IsSuccess());
47+
48+
// The error should indicate invalid region, not network failure
49+
if (!outcome.IsSuccess()) {
50+
auto error = outcome.GetError();
51+
std::cout << "Error type: " << static_cast<int>(error.GetErrorType()) << std::endl;
52+
std::cout << "Error message: " << error.GetMessage() << std::endl;
53+
}
54+
}
55+
56+
TEST_F(SSRFProtectionTest, TestSNSClientWithValidRegion)
57+
{
58+
// Test with valid region
59+
Aws::Client::ClientConfiguration config;
60+
config.region = "us-east-1";
61+
62+
auto snsClient = Aws::MakeShared<SNSClient>(ALLOCATION_TAG, config);
63+
64+
// This should work (though may fail due to credentials, not region)
65+
ListTopicsRequest request;
66+
auto outcome = snsClient->ListTopics(request);
67+
68+
std::cout << "Valid region test - Success: " << outcome.IsSuccess() << std::endl;
69+
if (!outcome.IsSuccess()) {
70+
auto error = outcome.GetError();
71+
std::cout << "Error type: " << static_cast<int>(error.GetErrorType()) << std::endl;
72+
std::cout << "Error message: " << error.GetMessage() << std::endl;
73+
}
74+
}
75+
}

‎tests/aws-cpp-sdk-sso-integration-tests/CMakeLists.txt‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
add_project(aws-cpp-sdk-sso-integration-tests
2+
"Tests for the AWS SSO C++ SDK"
3+
aws-cpp-sdk-sso
4+
testing-resources
5+
aws-cpp-sdk-core)
6+
7+
file(GLOB AWS_SSO_SRC
8+
"${CMAKE_CURRENT_SOURCE_DIR}/*.cpp"
9+
)
10+
11+
file(GLOB AWS_SSO_INTEGRATION_TESTS_SRC
12+
${AWS_SSO_SRC}
13+
)
14+
15+
if(MSVC AND BUILD_SHARED_LIBS)
16+
add_definitions(-DGTEST_LINKED_AS_SHARED_LIBRARY=1)
17+
endif()
18+
19+
enable_testing()
20+
21+
if(PLATFORM_ANDROID AND BUILD_SHARED_LIBS)
22+
add_library(${PROJECT_NAME} ${AWS_SSO_INTEGRATION_TESTS_SRC})
23+
else()
24+
add_executable(${PROJECT_NAME} ${AWS_SSO_INTEGRATION_TESTS_SRC})
25+
endif()
26+
27+
set_compiler_flags(${PROJECT_NAME})
28+
set_compiler_warnings(${PROJECT_NAME})
29+
30+
target_link_libraries(${PROJECT_NAME} ${PROJECT_LIBS})

‎tests/aws-cpp-sdk-sso-integration-tests/RunTests.cpp‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#include <gtest/gtest.h>
2+
#include <aws/core/Aws.h>
3+
#include <aws/testing/platform/PlatformTesting.h>
4+
#include <aws/testing/TestingEnvironment.h>
5+
#include <aws/testing/MemoryTesting.h>
6+
7+
int main(int argc, char** argv)
8+
{
9+
Aws::Testing::SetDefaultSigPipeHandler();
10+
Aws::SDKOptions options;
11+
options.loggingOptions.logLevel = Aws::Utils::Logging::LogLevel::Trace;
12+
AWS_BEGIN_MEMORY_TEST_EX(options, 1024, 128);
13+
14+
Aws::Testing::InitPlatformTest(options);
15+
Aws::Testing::ParseArgs(argc, argv);
16+
17+
Aws::InitAPI(options);
18+
::testing::InitGoogleTest(&argc, argv);
19+
int exitCode = RUN_ALL_TESTS();
20+
21+
Aws::ShutdownAPI(options);
22+
AWS_END_MEMORY_TEST_EX;
23+
Aws::Testing::ShutdownPlatformTest(options);
24+
return exitCode;
25+
}

‎tests/aws-cpp-sdk-sso-integration-tests/SSOCredentialSSRFTest.cpp‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
#include <gtest/gtest.h>
2+
#include <aws/testing/AwsTestHelpers.h>
3+
#include <aws/core/client/ClientConfiguration.h>
4+
#include <aws/core/Aws.h>
5+
#include <aws/sso/SSOClient.h>
6+
#include <aws/sso/model/ListAccountsRequest.h>
7+
8+
using namespace Aws;
9+
using namespace Aws::SSO;
10+
using namespace Aws::SSO::Model;
11+
12+
namespace
13+
{
14+
static const char ALLOCATION_TAG[] = "SSOCredentialSSRFTest";
15+
16+
class SSOCredentialSSRFTest : public ::testing::Test
17+
{
18+
protected:
19+
void SetUp() override
20+
{
21+
Aws::InitAPI(options);
22+
}
23+
24+
void TearDown() override
25+
{
26+
Aws::ShutdownAPI(options);
27+
}
28+
29+
Aws::SDKOptions options;
30+
};
31+
32+
TEST_F(SSOCredentialSSRFTest, TestSSOClientRejectsMaliciousRegion)
33+
{
34+
// Test malicious region with @ character that could redirect to attacker.com
35+
Aws::Client::ClientConfiguration config;
36+
config.region = "@attacker.com#";
37+
38+
auto ssoClient = Aws::MakeShared<SSOClient>(ALLOCATION_TAG, config);
39+
40+
// Try ListAccounts - simple operation
41+
ListAccountsRequest request;
42+
request.SetAccessToken("dummy-token");
43+
auto outcome = ssoClient->ListAccounts(request);
44+
45+
// The request should fail (not redirect to attacker.com)
46+
EXPECT_FALSE(outcome.IsSuccess());
47+
48+
if (!outcome.IsSuccess()) {
49+
auto error = outcome.GetError();
50+
std::cout << "Error type: " << static_cast<int>(error.GetErrorType()) << std::endl;
51+
std::cout << "Error message: " << error.GetMessage() << std::endl;
52+
}
53+
}
54+
55+
TEST_F(SSOCredentialSSRFTest, TestSSOClientWithValidRegion)
56+
{
57+
// Test with valid region
58+
Aws::Client::ClientConfiguration config;
59+
config.region = "us-east-1";
60+
61+
auto ssoClient = Aws::MakeShared<SSOClient>(ALLOCATION_TAG, config);
62+
63+
ListAccountsRequest request;
64+
request.SetAccessToken("dummy-token");
65+
auto outcome = ssoClient->ListAccounts(request);
66+
67+
std::cout << "Valid region test - Success: " << outcome.IsSuccess() << std::endl;
68+
if (!outcome.IsSuccess()) {
69+
auto error = outcome.GetError();
70+
std::cout << "Error type: " << static_cast<int>(error.GetErrorType()) << std::endl;
71+
std::cout << "Error message: " << error.GetMessage() << std::endl;
72+
}
73+
}
74+
}

‎tests/aws-cpp-sdk-sts-integration-tests/CMakeLists.txt‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
add_project(aws-cpp-sdk-sts-integration-tests
2+
"Tests for the AWS STS C++ SDK"
3+
aws-cpp-sdk-sts
4+
testing-resources
5+
aws-cpp-sdk-core)
6+
7+
file(GLOB AWS_STS_SRC
8+
"${CMAKE_CURRENT_SOURCE_DIR}/*.cpp"
9+
)
10+
11+
file(GLOB AWS_STS_INTEGRATION_TESTS_SRC
12+
${AWS_STS_SRC}
13+
)
14+
15+
if(MSVC AND BUILD_SHARED_LIBS)
16+
add_definitions(-DGTEST_LINKED_AS_SHARED_LIBRARY=1)
17+
endif()
18+
19+
enable_testing()
20+
21+
if(PLATFORM_ANDROID AND BUILD_SHARED_LIBS)
22+
add_library(${PROJECT_NAME} ${AWS_STS_INTEGRATION_TESTS_SRC})
23+
else()
24+
add_executable(${PROJECT_NAME} ${AWS_STS_INTEGRATION_TESTS_SRC})
25+
endif()
26+
27+
set_compiler_flags(${PROJECT_NAME})
28+
set_compiler_warnings(${PROJECT_NAME})
29+
30+
target_link_libraries(${PROJECT_NAME} ${PROJECT_LIBS})

‎tests/aws-cpp-sdk-sts-integration-tests/RunTests.cpp‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#include <gtest/gtest.h>
2+
#include <aws/core/Aws.h>
3+
#include <aws/testing/platform/PlatformTesting.h>
4+
#include <aws/testing/TestingEnvironment.h>
5+
#include <aws/testing/MemoryTesting.h>
6+
7+
int main(int argc, char** argv)
8+
{
9+
Aws::Testing::SetDefaultSigPipeHandler();
10+
Aws::SDKOptions options;
11+
options.loggingOptions.logLevel = Aws::Utils::Logging::LogLevel::Trace;
12+
AWS_BEGIN_MEMORY_TEST_EX(options, 1024, 128);
13+
14+
Aws::Testing::InitPlatformTest(options);
15+
Aws::Testing::ParseArgs(argc, argv);
16+
17+
Aws::InitAPI(options);
18+
::testing::InitGoogleTest(&argc, argv);
19+
int exitCode = RUN_ALL_TESTS();
20+
21+
Aws::ShutdownAPI(options);
22+
AWS_END_MEMORY_TEST_EX;
23+
Aws::Testing::ShutdownPlatformTest(options);
24+
return exitCode;
25+
}

‎tests/aws-cpp-sdk-sts-integration-tests/STSCredentialSSRFTest.cpp‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
#include <gtest/gtest.h>
2+
#include <aws/testing/AwsTestHelpers.h>
3+
#include <aws/core/client/ClientConfiguration.h>
4+
#include <aws/core/Aws.h>
5+
#include <aws/sts/STSClient.h>
6+
#include <aws/sts/model/GetCallerIdentityRequest.h>
7+
8+
using namespace Aws;
9+
using namespace Aws::STS;
10+
using namespace Aws::STS::Model;
11+
12+
namespace
13+
{
14+
static const char ALLOCATION_TAG[] = "STSCredentialSSRFTest";
15+
16+
class STSCredentialSSRFTest : public ::testing::Test
17+
{
18+
protected:
19+
void SetUp() override
20+
{
21+
Aws::InitAPI(options);
22+
}
23+
24+
void TearDown() override
25+
{
26+
Aws::ShutdownAPI(options);
27+
}
28+
29+
Aws::SDKOptions options;
30+
};
31+
32+
TEST_F(STSCredentialSSRFTest, TestSTSClientRejectsMaliciousRegion)
33+
{
34+
// Test malicious region with @ character that could redirect to attacker.com
35+
Aws::Client::ClientConfiguration config;
36+
config.region = "@attacker.com#";
37+
38+
auto stsClient = Aws::MakeShared<STSClient>(ALLOCATION_TAG, config);
39+
40+
// Try GetCallerIdentity - simple operation that works with any credentials
41+
GetCallerIdentityRequest request;
42+
auto outcome = stsClient->GetCallerIdentity(request);
43+
44+
// The request should fail (not redirect to attacker.com)
45+
EXPECT_FALSE(outcome.IsSuccess());
46+
47+
if (!outcome.IsSuccess()) {
48+
auto error = outcome.GetError();
49+
std::cout << "Error type: " << static_cast<int>(error.GetErrorType()) << std::endl;
50+
std::cout << "Error message: " << error.GetMessage() << std::endl;
51+
}
52+
}
53+
54+
TEST_F(STSCredentialSSRFTest, TestSTSClientWithValidRegion)
55+
{
56+
// Test with valid region
57+
Aws::Client::ClientConfiguration config;
58+
config.region = "us-east-1";
59+
60+
auto stsClient = Aws::MakeShared<STSClient>(ALLOCATION_TAG, config);
61+
62+
GetCallerIdentityRequest request;
63+
auto outcome = stsClient->GetCallerIdentity(request);
64+
65+
std::cout << "Valid region test - Success: " << outcome.IsSuccess() << std::endl;
66+
if (!outcome.IsSuccess()) {
67+
auto error = outcome.GetError();
68+
std::cout << "Error type: " << static_cast<int>(error.GetErrorType()) << std::endl;
69+
std::cout << "Error message: " << error.GetMessage() << std::endl;
70+
}
71+
}
72+
}

0 commit comments

Comments
 (0)