aws-sam: two YAML-based checks (handler-path, cloudfront-authorization) via a minimal YAML parser - #137
Merged
Conversation
…hecks Enough to query SAM/CloudFormation template structure (nested block maps, block + flow sequences, scalars, CloudFormation !Tags kept as their value); deliberately not a general parser (no anchors, block scalars, or flow maps) and never throws. 9 tests including the SAM function and CloudFront OriginRequestPolicy structures the two checks need. Refs #136 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015vFRrv67zrVJkQ4UTVxWr5
…ation Convert the two SAM gotchas the first prose-to-checks pass rejected as FP-prone, now made false-positive-free by navigating template structure via the minimal YAML parser: - handler-path: under BuildMethod esbuild with a single subdir entry and no OutBase, the Handler must drop the subdir. Skips the OutBase and multi-entry cases the adversarial pass flagged. - cloudfront-authorization: a custom OriginRequestPolicy may not list Authorization. Scoped to the policy's own headers, so Authorization in an API Gateway authorizer elsewhere is not flagged. Both blocking, each with fixtures including the adversarial FP cases. aws-sam pack now has 3 checks; catalog 22 -> 24. Closes #136 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015vFRrv67zrVJkQ4UTVxWr5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the prose-to-checks pass (#131). The first pass rejected two aws-sam gotchas as false-positive-prone because a text-grep can't tell template structure. This adds a small dependency-free YAML-subset parser and converts both, FP-free.
What's here
checks/lib/yaml.mjs— a minimal YAML-subset parser (nested block maps, block + flow sequences, scalars, CloudFormation!Tagskept as their value). Deliberately not a general parser (no anchors, block scalars, or flow maps) and never throws. 9 tests.checks/lib/cfn.mjs— parses the repo's SAM templates into resources.aws-sam/handler-path(blocking) — underBuildMethod: esbuildwith a single subdirectory entry point and noOutBase, theHandlermust drop the subdir. FP fixes (from the adversarial pass): skips whenOutBaseis set or there are multiple entry points.aws-sam/cloudfront-authorization(blocking) — a customAWS::CloudFront::OriginRequestPolicymay not listAuthorization(AWS rejects it at deploy). FP fix: scoped to the policy's own headers, soAuthorizationin an API Gateway authorizer elsewhere is not flagged.Each check has fixtures that include the exact false-positive cases the first pass got caught on — proving the narrowing works. The third rejected candidate (chrome
SetIcon({path})) is JS, not YAML, so it stays backlogged.aws-sam pack now has 3 checks; corpus catalog 22 → 24. 64 tests, sweep clean.
Closes #136
🤖 Generated with Claude Code
https://claude.ai/code/session_015vFRrv67zrVJkQ4UTVxWr5
Generated by Claude Code