Merge from Master - #1
Open
reclaim0982 wants to merge 51 commits into
Open
Conversation
…pressed payload<1MB) for large file
…PATTERN, S3_IGNORE_PATTERN env variables BATCH_SIZE_FACTOR: affects uncompressed batch size, default: 1.5 S3_CLOUDTRAIL_LOG_PATTERN: regex pattern to match CloudTrail log file, default: .*CloudTrail.*\.json.gz$ S3_IGNORE_PATTERN: regex pattern to match log file to be ignored/skipped, default: $^
…ar BATCH_SIZE_FACTOR
Incremented version to 1.1.2
Increment version to 1.1.2
This is needed so SAM takes care of the dependency management when packaging
Fix structure for SAM and update version in the template
Adding developer docs and makefile
Added PermissionsBoundary and FunctionRole optional parameters
* Update README.md Updated to Community Plus header * Fix typo docume to document Co-authored-by: Daniel Rodríguez <daniel@dpstudios.es>
Co-authored-by: Daniel Rodríguez <daniel@dpstudios.es>
* Upgrade dependencies versions because vulnerability issues * Version bump to v1.1.4
Allow adding additional attributes
feat: bump Python runtime version to v3.11
Fix for library vulnerabilities
Issue with CloudTrail digest fixed
…h_fix Fix python requirements file path in serverless configuration
Fix for vulnerable libraries
fixing vulnerabilities
fixing CVEs
feat: Upgrade Lambda runtime to Python 3.12
NR-560729 Add Japan region support for log ingestion endpoint
Bump version to 1.4.0 for Japan region release
Update JP endpoint from log-api.jp.newrelic.com to log-api.jp.nr-data.net as the newrelic.com hostname has no DNS record. Bump version to 1.4.1.
The JP logging endpoint has been migrated from log-api.jp.newrelic.com to log-api.jp.nr-data.net. Update the endpoint URL to reflect this change.
The CloudTrail and CloudTrail-Digest regex patterns used two greedy wildcards (.*) that could overlap, causing the regex engine to take exponentially longer on certain S3 key inputs. This is flagged by CodeQL as a Polynomial ReDoS vulnerability (py/polynomial-redos). Fixed by: - Removing the unnecessary leading .* (re.search already matches anywhere in the string) - Replacing the remaining .* with [^/]* so it only matches within a single path segment, preventing catastrophic backtracking - Escaping literal dots in .json.gz and using raw strings
CodeQL still flags re.search() with [^/]* because the engine tries every starting position in the string (O(n)) and at each match of the literal prefix, [^/]* backtracks up to O(n) characters — giving O(n^2) on inputs with repeated 'CloudTrail-Digest' substrings. Fix by using str.endswith() and 'in' checks for the default patterns, which are guaranteed O(n). A custom regex via S3_CLOUD_TRAIL_LOG_PATTERN env var is still supported for users who need it.
Fix polynomial ReDoS in CloudTrail regex patterns (py/polynomial-redos)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
15 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge from Master