github-actions[bot] commented on code in PR #41130:
URL: https://github.com/apache/beam/pull/41130#discussion_r4517159503
##########
sdks/java/io/amazon-web-services2/src/main/java/org/apache/beam/sdk/io/aws2/options/AwsModule.java:
##########
@@ -204,12 +206,28 @@ public AwsCredentialsProvider deserializeWithType(
.orElse(
StsAssumeRoleForFederatedCredentialsProvider.DEFAULT_SESSION_DURATION_SECS))
.build();
+ } else if
(typeName.equals(SecretCredentialsProvider.class.getSimpleName())) {
+ return SecretCredentialsProvider.create(
+ getNotNull(json, SECRET_MANAGER, typeName),
+ getSpec(json, ACCESS_KEY_ID, typeName),
+ getSpec(json, SECRET_ACCESS_KEY, typeName),
+ json.has(SESSION_TOKEN) ? getSpec(json, SESSION_TOKEN, typeName) :
null);
} else {
throw new IOException(
String.format("AWS credential provider type '%s' is not
supported", typeName));
}
}
+ /**
+ * Returns a secret spec, which may be given as a JSON string or, to avoid
escaping, as a JSON
+ * object.
+ */
+ private String getSpec(JsonNode json, String key, String typeName) {
+ JsonNode node = json.get(key);
+ checkNotNull(node, "AWS credentials provider type '%s' is missing '%s'",
typeName, key);
+ return node.isTextual() ? node.textValue() : node.toString();
Review Comment:
**🟡 Medium**: If a spec field is explicitly set to `null` in JSON (e.g.,
`"sessionToken": null` or `"accessKeyId": null`), `json.get(key)` returns a
Jackson `NullNode` (which is non-null in Java and not textual). Calling
`node.toString()` on a `NullNode` returns the 4-character string `"null"`,
which passes `!Strings.isNullOrEmpty(...)` validation in
`SecretCredentialsProvider.create` and will be treated as an actual secret
spec. Using `node.isObject() ? node.toString() : node.textValue()` ensures only
JSON objects are serialized via `toString()`, while `NullNode` (or other
non-string/non-object nodes) yields `null`.
```suggestion
return node.isObject() ? node.toString() : node.textValue();
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
