fix(auth): replace resource URI regex with linear validation

Author: bfreiberg

aws_lambda_powertools/utilities/auth_alpha/oauth2/client.py

@@ -6,6 +6,7 @@
 import time
 from collections.abc import Mapping
 from dataclasses import dataclass, field
+from string import ascii_letters, digits, hexdigits
 from typing import TYPE_CHECKING, Any
 from urllib.parse import quote_plus, urlencode, urlsplit
 
@@ -27,7 +28,20 @@
 
 _BEARER_TOKEN = re.compile(r"[-A-Za-z0-9._~+/]+=*")
 _HEADER_NAME = re.compile(r"[-!#$%&'*+.^_`|~0-9A-Za-z]+")
-_RESOURCE_URI = re.compile(r"[A-Za-z][A-Za-z0-9+.-]*:(?:[A-Za-z0-9._~:/?\[\]@!$&'()*+,;=-]|%[0-9A-Fa-f]{2})*")
+_RESOURCE_CHARACTERS = frozenset(ascii_letters + digits + "-._~:/?[]@!$&'()*+,;=")
+_HEX_DIGITS = frozenset(hexdigits)
+
+
+def _valid_resource_characters(resource: str) -> bool:
+    """Scan once, accepting URI characters and complete percent escapes, but no fragment."""
+    characters = iter(resource)
+    for character in characters:
+        if character == "%":
+            if next(characters, "") not in _HEX_DIGITS or next(characters, "") not in _HEX_DIGITS:
+                return False
+        elif character not in _RESOURCE_CHARACTERS:
+            return False
+    return True
 
 
 @dataclass(frozen=True)
@@ -138,7 +152,9 @@ def __repr__(self) -> str:
     @staticmethod
     def _validate_resource(resource: str) -> None:
         try:
-            valid = bool(_RESOURCE_URI.fullmatch(resource)) and bool(urlsplit(resource).scheme)
+            scheme = urlsplit(resource).scheme
+            # Older urlsplit versions also recognize schemes starting with a digit.
+            valid = scheme[:1].isalpha() and _valid_resource_characters(resource)
         except ValueError:
             valid = False
         if not valid:

tests/functional/auth_alpha/oauth2/test_client.py

@@ -565,6 +565,14 @@ def test_invalid_configuration_encoding_is_rejected(field):
         "https://inventory.example.com/stock item",
         "https://inventory.example.com/%invalid",
         "https://[invalid",
+        "1inventory:stock",
+        "urn%3Ainventory",
+        "urn:inventory%",
+        "urn:inventory%2",
+        "urn:inventory%2G",
+        "urn:inventory%G2",
+        "urn:inventory%%20",
+        "urn:inventorý",
     ],
 )
 def test_resource_must_be_an_absolute_uri_without_a_fragment(resource):
@@ -578,6 +586,9 @@ def test_resource_must_be_an_absolute_uri_without_a_fragment(resource):
         {"resource": "urn:example:inventory"},
         {"resource": "https://inventory.example.com/stock?region=eu&category=%23parts"},
         {"resource": "http://inventory.example.com"},
+        {"resource": "URN:example:inventory"},
+        {"resource": "inventory+v1.2-test:stock%2fitems%20eu?category=%23"},
+        {"resource": "https://[::1]/caf%C3%A9?encoded=%00%ff"},
         {"audience": "inventory"},
     ],
 )
@@ -594,6 +605,22 @@ def test_valid_resource_identifiers_and_provider_audiences_are_preserved(http, s
     assert other not in fields
 
 
+@pytest.mark.parametrize("suffix", ["%", "%4", "%4G", "#"])
+def test_long_resources_with_invalid_suffixes_are_rejected_before_loading_credentials(http, suffix):
+    secrets = []
+
+    def load_secret():
+        secrets.append("test-secret")
+        return secrets[-1]
+
+    resource = "urn:inventory:" + "a%41" * 25_000 + suffix
+    with pytest.raises(ValueError, match="absolute URI without a fragment"):
+        client(resource=resource, client_secret=load_secret)
+
+    assert secrets == []
+    assert http.requests == []
+
+
 def test_secret_lookup_does_not_expire_a_new_short_lived_token(http, clock):
     def load_secret():
         clock.advance(2)