refactor(ec2): enforce ssh key inside global storage.

packages/core/src/awsService/ec2/sshKeyPair.ts

@@ -2,12 +2,13 @@
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-import { fs } from '../../shared'
+import { fs, globals } from '../../shared'
 import { ToolkitError } from '../../shared/errors'
 import { tryRun } from '../../shared/utilities/pathFind'
 import { Timeout } from '../../shared/utilities/timeoutUtils'
 import { findAsync } from '../../shared/utilities/collectionUtils'
 import { RunParameterContext } from '../../shared/utilities/processUtils'
+import path from 'path'
 
 type sshKeyType = 'rsa' | 'ed25519'
 
@@ -28,10 +29,25 @@ export class SshKeyPair {
     }
 
     public static async getSshKeyPair(keyPath: string, lifetime: number) {
+        SshKeyPair.assertValidKeypath(
+            keyPath,
+            `ec2: unable to generate key outside of global storage in path ${keyPath}`
+        )
         await SshKeyPair.generateSshKeyPair(keyPath)
         return new SshKeyPair(keyPath, lifetime)
     }
 
+    private static isValidKeyPath(keyPath: string): boolean {
+        const relative = path.relative(globals.context.globalStorageUri.fsPath, keyPath)
+        return relative !== undefined && !relative.startsWith('..') && !path.isAbsolute(relative)
+    }
+
+    private static assertValidKeypath(keyPath: string, message: string): void | never {
+        if (!SshKeyPair.isValidKeyPath(keyPath)) {
+            throw new ToolkitError(message)
+        }
+    }
+
     public static async generateSshKeyPair(keyPath: string): Promise<void> {
         const keyGenerated = await this.tryKeyTypes(keyPath, ['ed25519', 'rsa'])
         if (!keyGenerated) {
@@ -72,6 +88,10 @@ export class SshKeyPair {
     }
 
     public async delete(): Promise<void> {
+        SshKeyPair.assertValidKeypath(
+            this.keyPath,
+            `ec2: keyPath became invalid after creation, not deleting key at ${this.keyPath}`
+        )
         await fs.delete(this.keyPath)
         await fs.delete(this.publicKeyPath)
 

packages/core/src/test/awsService/ec2/model.test.ts

@@ -13,6 +13,8 @@ import { ToolkitError } from '../../../shared/errors'
 import { IAM } from 'aws-sdk'
 import { SshKeyPair } from '../../../awsService/ec2/sshKeyPair'
 import { DefaultIamClient } from '../../../shared/clients/iamClient'
+import path from 'path'
+import { fs, globals } from '../../../shared'
 
 describe('Ec2ConnectClient', function () {
     let client: Ec2ConnectionManager
@@ -132,17 +134,19 @@ describe('Ec2ConnectClient', function () {
         it('calls the sdk with the proper parameters', async function () {
             const sendCommandStub = sinon.stub(SsmClient.prototype, 'sendCommandAndWait')
 
-            sinon.stub(SshKeyPair, 'generateSshKeyPair')
-            sinon.stub(SshKeyPair.prototype, 'getPublicKey').resolves('test-key')
-
             const testSelection = {
                 instanceId: 'test-id',
                 region: 'test-region',
             }
-            const mockKeys = await SshKeyPair.getSshKeyPair('fakeDir', 30000)
-            await client.sendSshKeyToInstance(testSelection, mockKeys, 'test-user')
+            const temporaryDirectory = path.join(globals.context.globalStorageUri.fsPath, 'ModelTests')
+            await fs.mkdir(temporaryDirectory)
+
+            const keys = await SshKeyPair.getSshKeyPair(path.join(temporaryDirectory, 'key'), 30000)
+            await client.sendSshKeyToInstance(testSelection, keys, 'test-user')
             sinon.assert.calledWith(sendCommandStub, testSelection.instanceId, 'AWS-RunShellScript')
             sinon.restore()
+
+            await fs.delete(temporaryDirectory, { force: true, recursive: true })
         })
     })
 

packages/core/src/test/awsService/ec2/sshKeyPair.test.ts

@@ -9,7 +9,7 @@ import * as sinon from 'sinon'
 import * as path from 'path'
 import * as os from 'os'
 import { SshKeyPair } from '../../../awsService/ec2/sshKeyPair'
-import { createTestWorkspaceFolder, installFakeClock } from '../../testUtil'
+import { installFakeClock } from '../../testUtil'
 import { InstalledClock } from '@sinonjs/fake-timers'
 import { ChildProcess } from '../../../shared/utilities/processUtils'
 import { fs, globals } from '../../../shared'
@@ -21,7 +21,10 @@ describe('SshKeyUtility', async function () {
     let clock: InstalledClock
 
     before(async function () {
-        temporaryDirectory = (await createTestWorkspaceFolder()).uri.fsPath
+        // Setup a temporary directory inside of globalStorage since keys need to be inside globalStorage
+        temporaryDirectory = path.join(globals.context.globalStorageUri.fsPath, 'SshKeyUtilityTests')
+        await fs.mkdir(temporaryDirectory)
+
         keyPath = path.join(temporaryDirectory, 'testKeyPair')
         clock = installFakeClock()
     })
@@ -134,6 +137,12 @@ describe('SshKeyUtility', async function () {
         assert(keyPair.isDeleted())
     })
 
+    it('does not allow writing keys to non-global storage', async function () {
+        await assert.rejects(async () => await SshKeyPair.getSshKeyPair('~/.ssh/someKey', 2000))
+
+        await assert.rejects(async () => await SshKeyPair.getSshKeyPair('/a/path/that/isnt/real/key', 2000))
+    })
+
     describe('isDeleted', async function () {
         it('returns false if key files exist', async function () {
             assert.strictEqual(await keyPair.isDeleted(), false)