Seed poc #1626
Seed poc #1626
Conversation
This reverts commit e2cdecb.
🦋 Changeset detectedLatest commit: d40d6a0 The changes in this PR will be included in the next version bump. This PR includes changesets to release 0 packagesWhen changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| ): Promise<AuthUser> => { | ||
| await this.lock.acquire(); | ||
| try { | ||
| console.log(`creating ${username}, ${password}`); |
Check failure
Code scanning / CodeQL
Clear-text logging of sensitive information High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 8 days ago
To fix the problem, we need to remove the logging of sensitive information such as passwords. Instead of logging the password, we can log a message indicating that a user is being created without including the sensitive details. This way, we maintain the ability to debug and monitor the process without exposing sensitive information.
- Remove the logging of the password in the
createUsermethod. - Log a message that does not include sensitive information.
| @@ -60,3 +60,3 @@ | ||
| try { | ||
| console.log(`creating ${username}, ${password}`); | ||
| console.log(`creating user: ${username}`); | ||
| const temporaryPassword = `Test1@Temp${randomUUID().toString()}`; |
| import { AuthClient, AuthUser, SeedFunction } from './types.js'; | ||
| import { DefaultAuthClient } from './auth_client.js'; | ||
| import { CognitoIdentityProviderClient } from '@aws-sdk/client-cognito-identity-provider'; | ||
| import { SchemaSeedable, Seedable } from '@aws-amplify/plugin-types'; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note
| import { defineSeed } from '@aws-amplify/backend'; | ||
| import type { Schema } from './data/resource'; | ||
| import { defineSeed2, KeysByType, PickByType } from '@aws-amplify/backend-seed'; | ||
| import { SchemaSeedable, Seedable } from '@aws-amplify/plugin-types'; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note test
| ); | ||
| }); | ||
|
|
||
| let foo: PickByType<typeof backend, Seedable<'auth'>>; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note test
| }); | ||
|
|
||
| let foo: PickByType<typeof backend, Seedable<'auth'>>; | ||
| let bar: PickByType<typeof backend, Seedable<'data'>>; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note test
| let foo: PickByType<typeof backend, Seedable<'auth'>>; | ||
| let bar: PickByType<typeof backend, Seedable<'data'>>; | ||
|
|
||
| let foo2: KeysByType<typeof backend, Seedable<'auth'>>; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note test
| let bar: PickByType<typeof backend, Seedable<'data'>>; | ||
|
|
||
| let foo2: KeysByType<typeof backend, Seedable<'auth'>>; | ||
| let bar2: KeysByType<typeof backend, Seedable<'data'>>; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note test
| * | ||
| * This means that schema type can be passed through defineData -> backend -> access backend props. | ||
| */ | ||
| let dataSchema = backend.data.schema; |
Check notice
Code scanning / CodeQL
Unused variable, import, function or class Note test
| } | ||
|
|
||
| createUser = async ( | ||
| username: string, |
Check failure
Code scanning / CodeQL
Insecure randomness High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 8 days ago
To fix the problem, we need to replace the use of Math.random() with a cryptographically secure random number generator. In Node.js, we can use the crypto module's randomUUID method to generate secure random values. This method provides a cryptographically secure way to generate random UUIDs, which can be used to create secure usernames and passwords.
We will update the test-projects/seed-poc3/amplify/seed.ts file to use crypto.randomUUID() instead of Math.random() for generating random parts of usernames and passwords.
| @@ -9,2 +9,3 @@ | ||
| import { generateClient } from 'aws-amplify/api'; | ||
| import { randomUUID } from 'crypto'; | ||
|
|
||
| @@ -24,3 +25,3 @@ | ||
| await dataClient.models.Todo.create({ | ||
| content: `Todo@${Math.random().toString()}`, | ||
| content: `Todo@${randomUUID()}`, | ||
| }); | ||
| @@ -28,4 +29,4 @@ | ||
| const user1 = await authClient.createUser( | ||
| `user${Math.random().toString()}@amazon.com`, | ||
| `P@ssword${Math.random().toString()}` | ||
| `user${randomUUID()}@amazon.com`, | ||
| `P@ssword${randomUUID()}` | ||
| ); | ||
| @@ -33,4 +34,4 @@ | ||
| const user2 = await authClient.createUser( | ||
| `user${Math.random().toString()}@amazon.com`, | ||
| `P@ssword${Math.random().toString()}` | ||
| `user${randomUUID()}@amazon.com`, | ||
| `P@ssword${randomUUID()}` | ||
| ); | ||
| @@ -44,3 +45,3 @@ | ||
| { | ||
| content: `Todo@${user1?.username ?? ''}@${Math.random().toString()}`, | ||
| content: `Todo@${user1?.username ?? ''}@${randomUUID()}`, | ||
| }, | ||
| @@ -63,3 +64,3 @@ | ||
| { | ||
| content: `Todo@${user2?.username ?? ''}@${Math.random().toString()}`, | ||
| content: `Todo@${user2?.username ?? ''}@${randomUUID()}`, | ||
| }, | ||
| @@ -74,4 +75,4 @@ | ||
| const uploadTask = storage.uploadData({ | ||
| data: `Some Content ${Math.random().toString()}`, | ||
| path: `foo/${Math.random().toString()}`, | ||
| data: `Some Content ${randomUUID()}`, | ||
| path: `foo/${randomUUID()}`, | ||
| }); | ||
| @@ -103,3 +104,3 @@ | ||
| { | ||
| content: `Todo2@${Math.random().toString()}`, | ||
| content: `Todo2@${randomUUID()}`, | ||
| }, | ||
| @@ -118,3 +119,2 @@ | ||
|
|
||
|
|
||
| // TODO: how can we use IAM creds with data client?? (and other clients?) |
|
|
||
| createUser = async ( | ||
| username: string, | ||
| password: string |
Check failure
Code scanning / CodeQL
Insecure randomness High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 8 days ago
To fix the problem, we need to replace the use of Math.random() with a cryptographically secure random number generator. In Node.js, we can use the crypto module's randomBytes method to generate secure random values. We will update the code in test-projects/seed-poc3/amplify/seed.ts to use crypto.randomBytes instead of Math.random() for generating passwords.
| @@ -9,2 +9,3 @@ | ||
| import { generateClient } from 'aws-amplify/api'; | ||
| import { randomBytes } from 'crypto'; | ||
|
|
||
| @@ -24,3 +25,3 @@ | ||
| await dataClient.models.Todo.create({ | ||
| content: `Todo@${Math.random().toString()}`, | ||
| content: `Todo@${randomBytes(4).toString('hex')}`, | ||
| }); | ||
| @@ -28,4 +29,4 @@ | ||
| const user1 = await authClient.createUser( | ||
| `user${Math.random().toString()}@amazon.com`, | ||
| `P@ssword${Math.random().toString()}` | ||
| `user${randomBytes(4).toString('hex')}@amazon.com`, | ||
| `P@ssword${randomBytes(4).toString('hex')}` | ||
| ); | ||
| @@ -33,4 +34,4 @@ | ||
| const user2 = await authClient.createUser( | ||
| `user${Math.random().toString()}@amazon.com`, | ||
| `P@ssword${Math.random().toString()}` | ||
| `user${randomBytes(4).toString('hex')}@amazon.com`, | ||
| `P@ssword${randomBytes(4).toString('hex')}` | ||
| ); | ||
| @@ -44,3 +45,3 @@ | ||
| { | ||
| content: `Todo@${user1?.username ?? ''}@${Math.random().toString()}`, | ||
| content: `Todo@${user1?.username ?? ''}@${randomBytes(4).toString('hex')}`, | ||
| }, | ||
| @@ -63,3 +64,3 @@ | ||
| { | ||
| content: `Todo@${user2?.username ?? ''}@${Math.random().toString()}`, | ||
| content: `Todo@${user2?.username ?? ''}@${randomBytes(4).toString('hex')}`, | ||
| }, | ||
| @@ -74,4 +75,4 @@ | ||
| const uploadTask = storage.uploadData({ | ||
| data: `Some Content ${Math.random().toString()}`, | ||
| path: `foo/${Math.random().toString()}`, | ||
| data: `Some Content ${randomBytes(4).toString('hex')}`, | ||
| path: `foo/${randomBytes(4).toString('hex')}`, | ||
| }); | ||
| @@ -103,3 +104,3 @@ | ||
| { | ||
| content: `Todo2@${Math.random().toString()}`, | ||
| content: `Todo2@${randomBytes(4).toString('hex')}`, | ||
| }, | ||
| @@ -118,3 +119,2 @@ | ||
|
|
||
|
|
||
| // TODO: how can we use IAM creds with data client?? (and other clients?) |
* feed pr base sha and ref into envs before scripts * removing empty file
Problem
Issue number, if available:
Changes
Corresponding docs PR, if applicable:
Validation
Checklist
run-e2elabel set.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.