Security: Logical ID uniqueness check can be bypassed via substring matching by tuanaiseo · Pull Request #3911 · aws/serverless-application-model

tuanaiseo · 2026-04-16T23:04:05Z

Problem

The verify_unique_logical_id function uses the in operator to compare resource types against do_not_verify entries. For mappings where the value is a string (not a list), in performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones.

Severity: medium
File: samtranslator/translator/verify_logical_id.py

Solution

Use strict type comparison. Normalize do_not_verify values to lists and compare with equality, e.g. allowed = do_not_verify[resource.resource_type]; allowed_types = allowed if isinstance(allowed, list) else [allowed]; return existing_type in allowed_types.

Changes

samtranslator/translator/verify_logical_id.py (modified)

Testing

Existing tests pass
Manual review completed
No new warnings/errors introduced

The `verify_unique_logical_id` function uses the `in` operator to compare resource types against `do_not_verify` entries. For mappings where the value is a string (not a list), `in` performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones. Affected files: verify_logical_id.py Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>

reedham-aws

I disagree that this is a security related fix, but I guess it's a good enough defensive programming adjustment.

valerena · 2026-05-05T23:32:32Z

There's an error when running make pr, so let's make sure to get that fixed.

aws#3911 - Security: normalize do_not_verify values to lists so `in` performs exact element matching instead of substring matching, preventing logical ID uniqueness check bypass via crafted resource types. aws#3939 - Globals.Function: Architectures at resource level now overrides the global value instead of being concatenated, since Lambda only supports a single architecture value. Introduced _list_override_properties frozenset in GlobalProperties to handle this class of properties. Tests: added tests/translator/test_verify_logical_id.py (9 tests) and 2 new cases in tests/plugins/globals/test_globals.py.

tuanaiseo · 2026-04-16T23:04:05Z

Problem

The verify_unique_logical_id function uses the in operator to compare resource types against do_not_verify entries. For mappings where the value is a string (not a list), in performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones.

Severity: medium
File: samtranslator/translator/verify_logical_id.py

Solution

Use strict type comparison. Normalize do_not_verify values to lists and compare with equality, e.g. allowed = do_not_verify[resource.resource_type]; allowed_types = allowed if isinstance(allowed, list) else [allowed]; return existing_type in allowed_types.

Changes

samtranslator/translator/verify_logical_id.py (modified)

Testing

Existing tests pass
Manual review completed
No new warnings/errors introduced

The `verify_unique_logical_id` function uses the `in` operator to compare resource types against `do_not_verify` entries. For mappings where the value is a string (not a list), `in` performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones. Affected files: verify_logical_id.py Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>

reedham-aws

I disagree that this is a security related fix, but I guess it's a good enough defensive programming adjustment.

valerena · 2026-05-05T23:32:32Z

There's an error when running make pr, so let's make sure to get that fixed.

aws#3911 - Security: normalize do_not_verify values to lists so `in` performs exact element matching instead of substring matching, preventing logical ID uniqueness check bypass via crafted resource types. aws#3939 - Globals.Function: Architectures at resource level now overrides the global value instead of being concatenated, since Lambda only supports a single architecture value. Introduced _list_override_properties frozenset in GlobalProperties to handle this class of properties. Tests: added tests/translator/test_verify_logical_id.py (9 tests) and 2 new cases in tests/plugins/globals/test_globals.py.

tuanaiseo · 2026-04-16T23:04:05Z

Problem

The verify_unique_logical_id function uses the in operator to compare resource types against do_not_verify entries. For mappings where the value is a string (not a list), in performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones.

Severity: medium
File: samtranslator/translator/verify_logical_id.py

Solution

Use strict type comparison. Normalize do_not_verify values to lists and compare with equality, e.g. allowed = do_not_verify[resource.resource_type]; allowed_types = allowed if isinstance(allowed, list) else [allowed]; return existing_type in allowed_types.

Changes

samtranslator/translator/verify_logical_id.py (modified)

Testing

Existing tests pass
Manual review completed
No new warnings/errors introduced

The `verify_unique_logical_id` function uses the `in` operator to compare resource types against `do_not_verify` entries. For mappings where the value is a string (not a list), `in` performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones. Affected files: verify_logical_id.py Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>

reedham-aws

I disagree that this is a security related fix, but I guess it's a good enough defensive programming adjustment.

valerena · 2026-05-05T23:32:32Z

There's an error when running make pr, so let's make sure to get that fixed.

aws#3911 - Security: normalize do_not_verify values to lists so `in` performs exact element matching instead of substring matching, preventing logical ID uniqueness check bypass via crafted resource types. aws#3939 - Globals.Function: Architectures at resource level now overrides the global value instead of being concatenated, since Lambda only supports a single architecture value. Introduced _list_override_properties frozenset in GlobalProperties to handle this class of properties. Tests: added tests/translator/test_verify_logical_id.py (9 tests) and 2 new cases in tests/plugins/globals/test_globals.py.

tuanaiseo · 2026-04-16T23:04:05Z

Problem

The verify_unique_logical_id function uses the in operator to compare resource types against do_not_verify entries. For mappings where the value is a string (not a list), in performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones.

Severity: medium
File: samtranslator/translator/verify_logical_id.py

Solution

Use strict type comparison. Normalize do_not_verify values to lists and compare with equality, e.g. allowed = do_not_verify[resource.resource_type]; allowed_types = allowed if isinstance(allowed, list) else [allowed]; return existing_type in allowed_types.

Changes

samtranslator/translator/verify_logical_id.py (modified)

Testing

Existing tests pass
Manual review completed
No new warnings/errors introduced

The `verify_unique_logical_id` function uses the `in` operator to compare resource types against `do_not_verify` entries. For mappings where the value is a string (not a list), `in` performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones. Affected files: verify_logical_id.py Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>

reedham-aws

I disagree that this is a security related fix, but I guess it's a good enough defensive programming adjustment.

valerena · 2026-05-05T23:32:32Z

There's an error when running make pr, so let's make sure to get that fixed.

aws#3911 - Security: normalize do_not_verify values to lists so `in` performs exact element matching instead of substring matching, preventing logical ID uniqueness check bypass via crafted resource types. aws#3939 - Globals.Function: Architectures at resource level now overrides the global value instead of being concatenated, since Lambda only supports a single architecture value. Introduced _list_override_properties frozenset in GlobalProperties to handle this class of properties. Tests: added tests/translator/test_verify_logical_id.py (9 tests) and 2 new cases in tests/plugins/globals/test_globals.py.

tuanaiseo · 2026-04-16T23:04:05Z

Problem

The verify_unique_logical_id function uses the in operator to compare resource types against do_not_verify entries. For mappings where the value is a string (not a list), in performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones.

Severity: medium
File: samtranslator/translator/verify_logical_id.py

Solution

Use strict type comparison. Normalize do_not_verify values to lists and compare with equality, e.g. allowed = do_not_verify[resource.resource_type]; allowed_types = allowed if isinstance(allowed, list) else [allowed]; return existing_type in allowed_types.

Changes

samtranslator/translator/verify_logical_id.py (modified)

Testing

Existing tests pass
Manual review completed
No new warnings/errors introduced

The `verify_unique_logical_id` function uses the `in` operator to compare resource types against `do_not_verify` entries. For mappings where the value is a string (not a list), `in` performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones. Affected files: verify_logical_id.py Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>

reedham-aws

I disagree that this is a security related fix, but I guess it's a good enough defensive programming adjustment.

valerena · 2026-05-05T23:32:32Z

There's an error when running make pr, so let's make sure to get that fixed.

aws#3911 - Security: normalize do_not_verify values to lists so `in` performs exact element matching instead of substring matching, preventing logical ID uniqueness check bypass via crafted resource types. aws#3939 - Globals.Function: Architectures at resource level now overrides the global value instead of being concatenated, since Lambda only supports a single architecture value. Introduced _list_override_properties frozenset in GlobalProperties to handle this class of properties. Tests: added tests/translator/test_verify_logical_id.py (9 tests) and 2 new cases in tests/plugins/globals/test_globals.py.

tuanaiseo · 2026-04-16T23:04:05Z

Problem

The verify_unique_logical_id function uses the in operator to compare resource types against do_not_verify entries. For mappings where the value is a string (not a list), in performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones.

Severity: medium
File: samtranslator/translator/verify_logical_id.py

Solution

Use strict type comparison. Normalize do_not_verify values to lists and compare with equality, e.g. allowed = do_not_verify[resource.resource_type]; allowed_types = allowed if isinstance(allowed, list) else [allowed]; return existing_type in allowed_types.

Changes

samtranslator/translator/verify_logical_id.py (modified)

Testing

Existing tests pass
Manual review completed
No new warnings/errors introduced

The `verify_unique_logical_id` function uses the `in` operator to compare resource types against `do_not_verify` entries. For mappings where the value is a string (not a list), `in` performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones. Affected files: verify_logical_id.py Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>

reedham-aws

I disagree that this is a security related fix, but I guess it's a good enough defensive programming adjustment.

valerena · 2026-05-05T23:32:32Z

There's an error when running make pr, so let's make sure to get that fixed.

aws#3911 - Security: normalize do_not_verify values to lists so `in` performs exact element matching instead of substring matching, preventing logical ID uniqueness check bypass via crafted resource types. aws#3939 - Globals.Function: Architectures at resource level now overrides the global value instead of being concatenated, since Lambda only supports a single architecture value. Introduced _list_override_properties frozenset in GlobalProperties to handle this class of properties. Tests: added tests/translator/test_verify_logical_id.py (9 tests) and 2 new cases in tests/plugins/globals/test_globals.py.

tuanaiseo · 2026-04-16T23:04:05Z

Problem

The verify_unique_logical_id function uses the in operator to compare resource types against do_not_verify entries. For mappings where the value is a string (not a list), in performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones.

Severity: medium
File: samtranslator/translator/verify_logical_id.py

Solution

Use strict type comparison. Normalize do_not_verify values to lists and compare with equality, e.g. allowed = do_not_verify[resource.resource_type]; allowed_types = allowed if isinstance(allowed, list) else [allowed]; return existing_type in allowed_types.

Changes

samtranslator/translator/verify_logical_id.py (modified)

Testing

Existing tests pass
Manual review completed
No new warnings/errors introduced

The `verify_unique_logical_id` function uses the `in` operator to compare resource types against `do_not_verify` entries. For mappings where the value is a string (not a list), `in` performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones. Affected files: verify_logical_id.py Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>

reedham-aws

I disagree that this is a security related fix, but I guess it's a good enough defensive programming adjustment.

valerena · 2026-05-05T23:32:32Z

There's an error when running make pr, so let's make sure to get that fixed.

aws#3911 - Security: normalize do_not_verify values to lists so `in` performs exact element matching instead of substring matching, preventing logical ID uniqueness check bypass via crafted resource types. aws#3939 - Globals.Function: Architectures at resource level now overrides the global value instead of being concatenated, since Lambda only supports a single architecture value. Introduced _list_override_properties frozenset in GlobalProperties to handle this class of properties. Tests: added tests/translator/test_verify_logical_id.py (9 tests) and 2 new cases in tests/plugins/globals/test_globals.py.

tuanaiseo · 2026-04-16T23:04:05Z

Problem

The verify_unique_logical_id function uses the in operator to compare resource types against do_not_verify entries. For mappings where the value is a string (not a list), in performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones.

Severity: medium
File: samtranslator/translator/verify_logical_id.py

Solution

Use strict type comparison. Normalize do_not_verify values to lists and compare with equality, e.g. allowed = do_not_verify[resource.resource_type]; allowed_types = allowed if isinstance(allowed, list) else [allowed]; return existing_type in allowed_types.

Changes

samtranslator/translator/verify_logical_id.py (modified)

Testing

Existing tests pass
Manual review completed
No new warnings/errors introduced

The `verify_unique_logical_id` function uses the `in` operator to compare resource types against `do_not_verify` entries. For mappings where the value is a string (not a list), `in` performs substring checks, not strict equality. This can allow unintended type matches (e.g., crafted type strings that are substrings), potentially bypassing logical ID collision detection and causing transformed resources to overwrite or collide with existing ones. Affected files: verify_logical_id.py Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com>

reedham-aws

I disagree that this is a security related fix, but I guess it's a good enough defensive programming adjustment.

valerena · 2026-05-05T23:32:32Z

There's an error when running make pr, so let's make sure to get that fixed.

aws#3911 - Security: normalize do_not_verify values to lists so `in` performs exact element matching instead of substring matching, preventing logical ID uniqueness check bypass via crafted resource types. aws#3939 - Globals.Function: Architectures at resource level now overrides the global value instead of being concatenated, since Lambda only supports a single architecture value. Introduced _list_override_properties frozenset in GlobalProperties to handle this class of properties. Tests: added tests/translator/test_verify_logical_id.py (9 tests) and 2 new cases in tests/plugins/globals/test_globals.py.

tuanaiseo requested a review from a team as a code owner April 16, 2026 23:04

reedham-aws approved these changes Apr 17, 2026
View reviewed changes

Hardikrepo mentioned this pull request Jun 29, 2026
fix: resolve issues #3911 and #3939 #3948
Closed
4 tasks