Unverified Commit f7e8ff05 authored by John DiSanti's avatar John DiSanti Committed by GitHub
Browse files

Don't capture empty session tokens from env (#906) 

* Don't capture empty session tokens from env

* Update changelog

* Incorporate feedback
parent cc82edf1

aws/SDK_CHANGELOG.md

+1 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ vNext (Month Day, Year) 
- Fix http-body dependency version (smithy-rs#883, aws-sdk-rust#305)

- [Added a new example showing how to set all currently supported timeouts](./sdk/examples/setting_timeouts/src/main.rs)

- Add a new check so that the SDK doesn't emit an irrelevant `$HOME` dir warning when running in a Lambda (aws-sdk-rust#307)

- :bug: Don't capture empty session tokens from the `AWS_SESSION_TOKEN` environment variable (aws-sdk-rust#316, smithy-rs#906)

- Add docs.rs metadata section to all crates to document all features



**Breaking changes**

aws/rust-runtime/aws-config/src/environment/credentials.rs

+29 −1
Original line number Diff line number Diff line
@@ -29,7 +29,15 @@ impl EnvironmentVariableCredentialsProvider { 
            .get("AWS_SECRET_ACCESS_KEY")

            .or_else(|_| self.env.get("SECRET_ACCESS_KEY"))

            .map_err(to_cred_error)?;

        let session_token = self.env.get("AWS_SESSION_TOKEN").ok();

        let session_token = self

            .env

            .get("AWS_SESSION_TOKEN")

            .ok()

            .map(|token| match token.trim() {

                s if s.is_empty() => None,

                s => Some(s.to_string()),

            })

            .flatten();

        Ok(Credentials::new(

            access_key,

            secret_key,
@@ -127,6 +135,26 @@ mod test { 
        assert_eq!(creds.secret_access_key(), "secret");

    }



    #[test]

    fn empty_token_env_var() {

        for token_value in &["", " "] {

            let provider = make_provider(&[

                ("AWS_ACCESS_KEY_ID", "access"),

                ("AWS_SECRET_ACCESS_KEY", "secret"),

                ("AWS_SESSION_TOKEN", token_value),

            ]);



            let creds = provider

                .provide_credentials()

                .now_or_never()

                .unwrap()

                .expect("valid credentials");

            assert_eq!(creds.access_key_id(), "access");

            assert_eq!(creds.secret_access_key(), "secret");

            assert_eq!(creds.session_token(), None);

        }

    }



    #[test]

    fn secret_key_fallback() {

        let provider = make_provider(&[