security suggestions

Author: msonnb

dev-packages/e2e-tests/test-applications/aws-lambda-sam/package.json

@@ -11,13 +11,15 @@
   },
   "//": "We just need the AWS layer zip file, not the NPM package",
   "devDependencies": {
-    "@sentry/aws-serverless": "link:../../../../packages/aws-serverless/build/aws/dist-serverless/",
     "@aws-sdk/client-lambda": "^3.863.0",
     "@playwright/test": "~1.53.2",
     "@sentry-internal/test-utils": "link:../../../test-utils",
+    "@sentry/aws-serverless": "link:../../../../packages/aws-serverless/build/aws/dist-serverless/",
+    "@types/tmp": "^0.2.6",
     "aws-cdk-lib": "^2.210.0",
     "constructs": "^10.4.2",
-    "glob": "^11.0.3"
+    "glob": "^11.0.3",
+    "tmp": "^0.2.5"
   },
   "volta": {
     "extends": "../../package.json"

dev-packages/e2e-tests/test-applications/aws-lambda-sam/stack.ts

@@ -6,7 +6,7 @@ import * as os from 'node:os';
 import * as dns from 'node:dns/promises';
 import { platform } from 'node:process';
 import { globSync } from 'glob';
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 
 const LAMBDA_FUNCTIONS_WITH_LAYER_DIR = './lambda-functions-layer';
 const LAMBDA_FUNCTIONS_WITH_NPM_DIR = './lambda-functions-npm';
@@ -70,7 +70,7 @@ export class LocalLambdaStack extends Stack {
         console.log(`[LocalLambdaStack] Install dependencies for ${functionName}`);
         const packageJson = { dependencies: { '@sentry/aws-serverless': '* || latest' } };
         fs.writeFileSync(path.join(functionsDir, lambdaDir, 'package.json'), JSON.stringify(packageJson, null, 2));
-        execSync(`npm install --prefix ${path.join(functionsDir, lambdaDir)}`);
+        execFileSync('npm', ['install', '--prefix', path.join(functionsDir, lambdaDir)], { stdio: 'inherit' });
       }
 
       const isEsm = fs.existsSync(path.join(functionsDir, lambdaDir, 'index.mjs'));

dev-packages/e2e-tests/test-applications/aws-lambda-sam/tests/lambda.test.ts

@@ -1,10 +1,9 @@
 import { test as base, expect } from '@playwright/test';
 import { waitForTransaction } from '@sentry-internal/test-utils';
 import { App } from 'aws-cdk-lib';
+import * as tmp from 'tmp';
 import { LocalLambdaStack, SAM_PORT, getHostIp } from '../stack.js';
-import { writeFileSync, openSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import * as path from 'node:path';
+import { writeFileSync } from 'node:fs';
 import { spawn, execSync } from 'node:child_process';
 import { InvokeCommand, LambdaClient } from '@aws-sdk/client-lambda';
 
@@ -26,9 +25,8 @@ const test = base.extend<{ testEnvironment: LocalLambdaStack; lambdaClient: Lamb
       const template = app.synth().getStackByName('LocalLambdaStack').template;
       writeFileSync(SAM_TEMPLATE_FILE, JSON.stringify(template, null, 2));
 
-      const debugLogFile = path.join(tmpdir(), 'sentry_aws_lambda_tests_sam_debug.log');
-      const debugLogFd = openSync(debugLogFile, 'w');
-      console.log(`[test_environment fixture] Writing SAM debug log to: ${debugLogFile}`);
+      const debugLog = tmp.fileSync({ prefix: 'sentry_aws_lambda_tests_sam_debug_', postfix: '.log' });
+      console.log(`[test_environment fixture] Writing SAM debug log to: ${debugLog.name}`);
 
       const process = spawn(
         'sam',
@@ -44,7 +42,7 @@ const test = base.extend<{ testEnvironment: LocalLambdaStack; lambdaClient: Lamb
           DOCKER_NETWORK_NAME,
         ],
         {
-          stdio: ['ignore', debugLogFd, debugLogFd],
+          stdio: ['ignore', debugLog.fd, debugLog.fd],
         },
       );