Merge branch 'release-1.45.18'

* release-1.45.18:
  Bumping version to 1.45.18
  Update changelog based on model updates
  Fix parent reference warning (#10362)
  Update restore-snapshot-from-recycle-bin.rst

Author: aws-sdk-python-automation

.changes/1.45.18.json

@@ -0,0 +1,47 @@
+[
+  {
+    "category": "``bedrock``",
+    "description": "Automated Reasoning checks - Added two build workflows for policies. Iterative Refine Policy uses AI to update policy definitions based on test results and feedback. Resolve Policy Ambiguities consolidates ambiguous variables in Automated Reasoning policies, a common source of ambiguous validation.",
+    "type": "api-change"
+  },
+  {
+    "category": "``bedrock-agentcore-control``",
+    "description": "Reference your own AWS Secrets Manager secrets when configuring credential providers, giving you control over encryption, rotation, and access policies instead of using service-managed secrets.",
+    "type": "api-change"
+  },
+  {
+    "category": "``groundstation``",
+    "description": "Adds support for Alpha-5 satellite number encoding in the Two-Line Element ephemeris format.",
+    "type": "api-change"
+  },
+  {
+    "category": "``omics``",
+    "description": "Add engineSettings to StartRun and GetRun. Add profiles and profileParameterTemplates to GetWorkflow and GetWorkflowVersion.",
+    "type": "api-change"
+  },
+  {
+    "category": "``quicksight``",
+    "description": "Adds support for creating, updating, describing, listing, and deleting an OAuthClientApplication resource, a new quicksight resource that allows customers to store OAuth configurations to connect to their databases via 3 Legged OAuth.",
+    "type": "api-change"
+  },
+  {
+    "category": "``rds-data``",
+    "description": "RDS Data API arrays (longValues, doubleValues, stringValues, booleanValues) in ExecuteStatement responses now correctly support null elements. Runtime change for JS v3 and .NET. Compile-time change for C plus plus, .NET, Kotlin, Rust. No impact for Java, Python, Ruby, PHP, Go.",
+    "type": "api-change"
+  },
+  {
+    "category": "``route53resolver``",
+    "description": "Added BatchCreateFirewallRule, BatchUpdateFirewallRule, BatchDeleteFirewallRule, and ListFirewallRuleTypes APIs. Added FirewallRuleType support to Firewall Rule APIs.",
+    "type": "api-change"
+  },
+  {
+    "category": "``sesv2``",
+    "description": "This release introduces support for Tenant Suppression Lists",
+    "type": "api-change"
+  },
+  {
+    "category": "s3",
+    "description": "Fix false negative in parent-directory escape detection that allowed keys like ``/../foo`` to bypass warning during downloads",
+    "type": "bugfix"
+  }
+]

CHANGELOG.rst

@@ -2,6 +2,20 @@
 CHANGELOG
 =========
 
+1.45.18
+=======
+
+* api-change:``bedrock``: Automated Reasoning checks - Added two build workflows for policies. Iterative Refine Policy uses AI to update policy definitions based on test results and feedback. Resolve Policy Ambiguities consolidates ambiguous variables in Automated Reasoning policies, a common source of ambiguous validation.
+* api-change:``bedrock-agentcore-control``: Reference your own AWS Secrets Manager secrets when configuring credential providers, giving you control over encryption, rotation, and access policies instead of using service-managed secrets.
+* api-change:``groundstation``: Adds support for Alpha-5 satellite number encoding in the Two-Line Element ephemeris format.
+* api-change:``omics``: Add engineSettings to StartRun and GetRun. Add profiles and profileParameterTemplates to GetWorkflow and GetWorkflowVersion.
+* api-change:``quicksight``: Adds support for creating, updating, describing, listing, and deleting an OAuthClientApplication resource, a new quicksight resource that allows customers to store OAuth configurations to connect to their databases via 3 Legged OAuth.
+* api-change:``rds-data``: RDS Data API arrays (longValues, doubleValues, stringValues, booleanValues) in ExecuteStatement responses now correctly support null elements. Runtime change for JS v3 and .NET. Compile-time change for C plus plus, .NET, Kotlin, Rust. No impact for Java, Python, Ruby, PHP, Go.
+* api-change:``route53resolver``: Added BatchCreateFirewallRule, BatchUpdateFirewallRule, BatchDeleteFirewallRule, and ListFirewallRuleTypes APIs. Added FirewallRuleType support to Firewall Rule APIs.
+* api-change:``sesv2``: This release introduces support for Tenant Suppression Lists
+* bugfix:s3: Fix false negative in parent-directory escape detection that allowed keys like ``/../foo`` to bypass warning during downloads
+
+
 1.45.17
 =======
 

awscli/__init__.py

@@ -18,7 +18,7 @@
 
 import os
 
-__version__ = '1.45.17'
+__version__ = '1.45.18'
 
 #
 # Get our data path to be added to botocore's search path

awscli/customizations/s3/s3handler.py

@@ -322,8 +322,10 @@ def _warn_parent_reference(self, fileinfo):
         # normpath() will use the OS path separator so we
         # need to take that into account when checking for a parent prefix.
         parent_prefix = '..' + os.path.sep
-        escapes_cwd = os.path.normpath(fileinfo.compare_key).startswith(
-            parent_prefix)
+        # Anchor compare_key against '.' (the destination directory root)
+        # to avoid false negatives on paths like '/../foo'
+        normalized = os.path.normpath('.' + os.path.sep + fileinfo.compare_key)
+        escapes_cwd = normalized.startswith(parent_prefix)
         if escapes_cwd:
             warning = create_warning(
                 fileinfo.compare_key, "File references a parent directory.")

awscli/examples/ec2/restore-snapshot-from-recycle-bin.rst

@@ -5,6 +5,18 @@ The following ``restore-snapshot-from-recycle-bin`` example restores a snapshot
     aws ec2 restore-snapshot-from-recycle-bin \
         --snapshot-id snap-01234567890abcdef
 
-This command produces no output.
+Output::
+
+    {
+        "SnapshotId": "snap-01234567890abcdef",
+        "Description": "Monthly data backup snapshot",
+        "Encrypted": false,
+        "OwnerId": "111122223333",
+        "Progress": "99%",
+        "StartTime": "2021-12-01T13:00:00.000000+00:00",
+        "State": "recovering",
+        "VolumeId": "vol-ffffffff",
+        "VolumeSize": 30
+    }
 
 For more information about Recycle Bin, see `Recover deleted snapshots from the Recycle Bin <https://docs.aws.amazon.com/ebs/latest/userguide/recycle-bin-working-with-snaps.html>`__ in the *Amazon EBS User Guide*.

doc/source/conf.py

@@ -52,7 +52,7 @@
 # The short X.Y version.
 version = '1.45.'
 # The full version, including alpha/beta/rc tags.
-release = '1.45.17'
+release = '1.45.18'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.

setup.cfg

@@ -3,7 +3,7 @@ universal = 0
 
 [metadata]
 requires_dist =
-        botocore==1.43.17
+        botocore==1.43.18
         docutils>=0.18.1,<=0.19
         s3transfer>=0.18.0,<0.19.0
         PyYAML>=3.10,<6.1

setup.py

@@ -24,7 +24,7 @@ def find_version(*file_paths):
 
 
 install_requires = [
-    'botocore==1.43.17',
+    'botocore==1.43.18',
     'docutils>=0.18.1,<=0.19',
     's3transfer>=0.18.0,<0.19.0',
     'PyYAML>=3.10,<6.1',

tests/unit/customizations/s3/test_s3handler.py

@@ -561,6 +561,27 @@ def test_allow_double_dots_that_dont_escape_cwd(self):
         future = self.transfer_request_submitter.submit(fileinfo)
         self.assertIsInstance(self.result_queue.get(), DryRunResult)
 
+    def test_warn_and_ignore_on_leading_slash_parent_reference(self):
+        fileinfo = self.create_file_info('/../foo.txt')
+        future = self.transfer_request_submitter.submit(fileinfo)
+        warning_result = self.result_queue.get()
+        self.assertIsInstance(warning_result, WarningResult)
+        self.assert_no_downloads_happened()
+
+    def test_warn_and_ignore_on_leading_slash_stacked_parent_reference(self):
+        fileinfo = self.create_file_info('/../../../foo/bar.txt')
+        future = self.transfer_request_submitter.submit(fileinfo)
+        warning_result = self.result_queue.get()
+        self.assertIsInstance(warning_result, WarningResult)
+        self.assert_no_downloads_happened()
+
+    def test_warn_and_ignore_on_double_leading_slash_parent_reference(self):
+        fileinfo = self.create_file_info('//../foo')
+        future = self.transfer_request_submitter.submit(fileinfo)
+        warning_result = self.result_queue.get()
+        self.assertIsInstance(warning_result, WarningResult)
+        self.assert_no_downloads_happened()
+
     def test_dry_run(self):
         self.cli_params['dryrun'] = True
         self.transfer_request_submitter = DownloadRequestSubmitter(