From 3b8c8fafe2a4c3ee1b1c70a0763fe1233b28086d Mon Sep 17 00:00:00 2001
From: gruebel <anton.gruebel@gmail.com>
Date: Wed, 6 May 2020 14:38:25 +0200
Subject: [PATCH] Fix ssm.get_parameters missing validation

---
 moto/ssm/models.py               | 10 ++++++++++
 tests/test_ssm/test_ssm_boto3.py | 27 +++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/moto/ssm/models.py b/moto/ssm/models.py
index 3ce3b3a22..67216972e 100644
--- a/moto/ssm/models.py
+++ b/moto/ssm/models.py
@@ -514,6 +514,16 @@ class SimpleSystemManagerBackend(BaseBackend):
 
     def get_parameters(self, names, with_decryption):
         result = []
+
+        if len(names) > 10:
+            raise ValidationException(
+                "1 validation error detected: "
+                "Value '[{}]' at 'names' failed to satisfy constraint: "
+                "Member must have length less than or equal to 10.".format(
+                    ", ".join(names)
+                )
+            )
+
         for name in names:
             if name in self._parameters:
                 result.append(self.get_parameter(name, with_decryption))
diff --git a/tests/test_ssm/test_ssm_boto3.py b/tests/test_ssm/test_ssm_boto3.py
index 170cd8a3e..e757a4006 100644
--- a/tests/test_ssm/test_ssm_boto3.py
+++ b/tests/test_ssm/test_ssm_boto3.py
@@ -1,5 +1,7 @@
 from __future__ import unicode_literals
 
+import string
+
 import boto3
 import botocore.exceptions
 import sure  # noqa
@@ -300,6 +302,31 @@ def test_get_parameter():
     )
 
 
+@mock_ssm
+def test_get_parameters_errors():
+    client = boto3.client("ssm", region_name="us-east-1")
+
+    ssm_parameters = {name: "value" for name in string.ascii_lowercase[:11]}
+
+    for name, value in ssm_parameters.items():
+        client.put_parameter(Name=name, Value=value, Type="String")
+
+    with assert_raises(ClientError) as e:
+        client.get_parameters(Names=list(ssm_parameters.keys()))
+    ex = e.exception
+    ex.operation_name.should.equal("GetParameters")
+    ex.response["ResponseMetadata"]["HTTPStatusCode"].should.equal(400)
+    ex.response["Error"]["Code"].should.contain("ValidationException")
+    ex.response["Error"]["Message"].should.equal(
+        "1 validation error detected: "
+        "Value '[{}]' at 'names' failed to satisfy constraint: "
+        "Member must have length less than or equal to 10.".format(
+            ", ".join(ssm_parameters.keys())
+        )
+    )
+    print(ex.response["Error"]["Message"])
+
+
 @mock_ssm
 def test_get_nonexistant_parameter():
     client = boto3.client("ssm", region_name="us-east-1")