Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

awslabs/serverless-application-model

              develop @ f29d329
            

Fixes

CVEs

HIGH

Peak severity

80.0%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

samtranslator/model/eventsources/push.py: most-fixed (2 issues). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A logic flow bug in API Gateway Open API translation prematurely terminated the application of default authorizers when encountering paths with explicit security configurations. This resulted in subsequent paths being silently left completely open without authorization. Developers must ensure iteration over template paths and security blocks is exhaustive and never short-circuited by local definitions.

Auth Bypass: Inconsistent validation allowed setting a method-level authorizer to 'NONE' without raising expected validation errors when global API authentication was undefined, allowing potentially unauthorized methods to slip through the translator. There is also a risk of over-permissive Lambda execution policies if named path parameters in API Gateway resources fail to map to proper wildcards in the IAM SourceArn.

Denial of Service: The template processor's recursive traversal routines are susceptible to infinite recursion and resource exhaustion when parsing cyclic or overlapping template configurations. Disambiguation of internal policy parameters from general CloudFormation parameters is critical to preventing loop conditions.