Yasuke/moto
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cognito-idp – Do not allow custom attributes in list_users() Filter param (#4389) (#4407)

Browse Source
This commit is contained in:
Maksymilian Babarowski 2021-10-13 11:55:58 +02:00 committed by GitHub
parent 5cf6f9b2b4
commit 4d10b11ecb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
moto/cognitoidp/responses.py
View File

@ -334,12 +334,26 @@ class CognitoIdpResponse(BaseResponse):
"username": lambda u: u.username,
}
comparisons = {"=": lambda x, y: x == y, "^=": lambda x, y: x.startswith(y)}
allowed_attributes = [
"username",
"email",
"phone_number",
"name",
"given_name",
"family_name",
"preferred_username",
"cognito:user_status",
"status",
"sub",
]
match = re.match(r"([\w:]+)\s*(=|\^=)\s*\"(.*)\"", filt)
if match:
name, op, value = match.groups()
else:
raise InvalidParameterException("Error while parsing filter")
if name not in allowed_attributes:
raise InvalidParameterException(f"Invalid search attribute: {name}")
compare = comparisons[op]
users = [
user

13
tests/test_cognitoidp/test_cognitoidp.py
View File

@ -1259,6 +1259,19 @@ def _assert_filter_parsing_error(exc):
assert err["Message"].should.equal("Error while parsing filter")
@mock_cognitoidp
def test_list_users_invalid_attributes():
conn = boto3.client("cognito-idp", "us-west-2")
user_pool_id = conn.create_user_pool(PoolName=str(uuid.uuid4()))["UserPool"]["Id"]
with pytest.raises(conn.exceptions.InvalidParameterException) as exc:
conn.list_users(UserPoolId=user_pool_id, Filter='custom:foo = "bar"')
err = exc.value.response["Error"]
assert err["Code"].should.equal("InvalidParameterException")
assert err["Message"].should.equal("Invalid search attribute: custom:foo")
@mock_cognitoidp
def test_list_users_inherent_attributes():
conn = boto3.client("cognito-idp", "us-west-2")