Rud5G

export interface EnvironmentConfig {
  env: {
    account: string;
    region: string;
  };
  stageName: string;
  stateful: {
    bucketName: string;
  };
  stateless: {

Rud5G

...

// add the feature-dev stage with the relevant environment config to the pipeline
// this is the test stage (beta)
const featureDevStage: PipelineStage = new PipelineStage(
  this,
  'FeatureDev',
  {
    ...environments.featureDev,
  }

Rud5G

APSB23-50

https://helpx.adobe.com/security/products/magento/apsb23-50.html

Privilege Escalation

The vulnerability with the highest CVSS score of 8.8 (CVE-2023-38218) states that it is an unauthenticated privilege escalation due to improper input validation.

If we look at the diff we see a number of security related changes. One of those changes is the following in Magento\Customer\Plugin\Webapi\Controller\Rest\ValidateCustomerData::validateInputData:

Rud5G

#
# Based on offical image from https://nextjs.org/docs/deployment#docker-image
# See dockerfile: https://github.com/vercel/next.js/blob/canary/examples/with-docker/Dockerfile
#

FROM node:16-alpine AS deps
RUN apk add --no-cache libc6-compat git curl python3 make g++
WORKDIR /opt/app
RUN addgroup --system --gid 1001 app
RUN adduser --system --uid 1001 app -h /opt/app

Rud5G

import { SSM } from 'aws-sdk';

/**
 * Get the value for a parameter in SSM Parameter Store. By default, decrypt
 * the value as we assume it is stored as a "SecretString"
 *
 * Ref: https://gist.github.com/cbschuld/938190f81d00934f7a158ff223fb5e02
 *
 * @param ssm The SSM client
 * @param name Name of the parameter

Rud5G

import { SSM } from "aws-sdk";

const getParameterWorker = async (name:string, decrypt:boolean) : Promise<string> => {
    const ssm = new SSM();
    const result = await ssm
    .getParameter({ Name: name, WithDecryption: decrypt })
    .promise();
    return result.Parameter.Value;
}

Rud5G

Let's say we've removed a Lambda Layer from the Lambda Console and are no longer able to perform operations using the Amplify CLI.

An error occurred fetching the latest layer version metadata for ""

> amplify remove function
? Choose the resource you would want to remove 10263layer58c94806 (layer)
When you delete a layer version, you can no longer configure functions to use it.
However, any function that already uses the layer version continues to have access to it.
✖ Loading layer data from the cloud...

Rud5G

#!/usr/bin/env node
const { existsSync: exists, promises: fs } = require('fs');
const { spawn } = require('child_process');
const path = require('path');
const c = require('chalk');
const dotenv = require('dotenv');
const nodemon = require('nodemon');

// set default node_env
process.env.NODE_ENV = process.env.NODE_ENV || 'development';

Rud5G

#!/bin/bash

# .git/hooks/post-checkout
# Utility to change AWS Amplify environments on branch checkout

# helper to get path to aws-exports.js
function get_aws_exports_path {
  local AMPLIFY_PROJECT_CONFIG_PATH="amplify/.config/project-config.json"
  local AMPLIFY_EXPORTS_PATH=$(jq -r '.javascript.config.SourceDir' $AMPLIFY_PROJECT_CONFIG_PATH)
  if [[ "$AMPLIFY_EXPORTS_PATH" == */ ]]

Rud5G

const fn = new lambda.NodejsFunction(this, 'MyFunction', {
  entry: fileURLToPath(new URL('./handler.ts', import.meta.url)),
  functionName: `my-function`,
  bundling: {
    minify: true, // minify code, defaults to false
    sourceMap: true, // include source map, defaults to false
    sourceMapMode: lambda.SourceMapMode.INLINE, // defaults to SourceMapMode.DEFAULT
    target: 'esnext',
    define: {
      'import.meta.vitest': 'undefined',